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GAO’S HIGH-RISK REPORT: 25 YEARS OF 
PROBLEMATIC PRACTICES 


Wednesday, February 11, 2015 

House of Representatives, 

Committee on Oversight and Government Reform, 

Washington, DC. 

The committee met, pursuant to notice, at 3:25 p.m., in room 
2154, Rayburn House Office Building, Hon. Jason Chaffetz (chair- 
man of the committee) presiding. 

Present: Representatives Chaffetz, Mica, Duncan, Jordan, 
Walberg, Amash, Gowdy, Massie, Meadows, DeSantis, Mulvaney, 
Cooper, Blum, Hice, Carter, Hurd, Palmer, Cummings, Maloney, 
Norton, Connolly, Lieu, Watson Coleman, Plaskett, and Lujan Gris- 
ham. 

Chairman Chaffetz. Committee on Oversight and Government 
Reform will come to order. 

Without objection, the chair is authorized to declare a recess at 
any time. 

We have an important hearing today. We appreciate the many 
people that are here to participate in that. We also appreciate the 
patience with votes on the floor that got called a little bit later. 
That always serves as the primary thing that we do in the after- 
noon around here. So we appreciate your patience. But, neverthe- 
less, we do have a very important hearing highlighting the “Gen- 
eral Accountability Office’s High-Risk Report: 25 Years of Problem- 
atic Practices.” This year marks the 25th anniversary of the GAO’s 
high-risk list. 

I have a full Statement, but in the essence of time, I am going 
to insert those comments into the record and would invite other 
Members to do the same. 

But I would now like to recognize the ranking member, Mr. 
Cummings, if he has any opening Statements. 

Mr. Cummings. Thank you very much, Mr. Chairman. 

I Am going to do the same. I want to thank all our witnesses. 
And I will submit my Statement for the record. 

And I want to always as usual thank you, Mr. Dodaro, and all 
of the GAO employees, who do a great job and help us so much. 

With that, I yield back. 

Chairman Chaffetz. Thank you. 

Chairman Chaffetz. I will hold the record open for 5 legislative 
days for any Member who would like to submit a written State- 
ment. 

And we would now like to recognize our first witness. I am 
pleased to welcome the Honorable Gene Dodaro, Comptroller of the 
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U.S. Government Accountability Office. He is accompanied by a 
panel of experts from the GAO. 

And, on behalf of both of us and this whole body, we thank the 
thousands of men and women who serve in the GAO who really 
work hard to create a work product and present it here today. 

So welcome to all. 

Pursuant to committee rules, the witness will be sworn in before 
he testifies. 

We will also swear in the panel behind him should their input 
be needed during their questioning. 

So if you could all rise, please. 

Thank you. If you will rise and please raise your right hands. Do 
you solemnly swear or affirm that the testimony you are about to 
give will be the truth, the whole truth, and nothing but the truth? 

Thank you. Let the record reflect that all the witnesses answered 
in the affirmative. 

Mr. Dodaro, you have testified before our committee several 
times. We will give you great latitude here, but we would appre- 
ciate your summarizing your comments, and then your entire writ- 
ten Statement will obviously be made part of the record. You are 
now recognized. 


WITNESS STATEMENTS 

STATEMENT OF HON. GENE L. DODARO 

Mr. Dodaro. Thank you very much, Mr. Chairman. Good after- 
noon to you. Ranking Member Cummings, all the members of the 
committee. I’m very pleased to be here today to discuss GAO’s lat- 
est high-risk update. We do this with the beginning of each new 
Congress to identify areas we believe are at highest risk of fraud, 
waste, abuse, and mismanagement in the Federal Government or 
in need of broad-based transformation. 

Our report today discusses solid, steady progress in most of the 
30 high-risk areas that we’ve had on the list since our last update 
in 2013. Of the — all the areas we rate according to five criteria to 
get off the high-risk list. You have to have leadership commitment; 
top level attention; you have to have the capacity, the resources 
and the people with the right skills to be able to fix the problem; 
you have to have a good corrective action plan that addresses root 
cause; a good monitoring effort with interim milestones and metrics 
that gauge progress; and you have to demonstrate that you’re actu- 
ally fixing the problem. You don’t have to be 100 percent fixed, but 
we have to be convinced that we’re on the right path to rectifying 
the problem and reducing the risk and eliminating waste and im- 
proving government services. 

Of the 30 areas, 18 have at least partially met all five criteria, 
and 11 of those 18 have at least fully met one or more of the cri- 
teria and partially met the others. In two areas, we’re recognizing 
progress so that we’re narrowing the scope of the high-risk area. 
First is on FDA’s oversight of medical devices. We are pleased with 
their efforts to get the recall process under better control and dis- 
cipline, and also to have a good process to review the applications 
for new devices in a more risk-based approach. We’re still con- 
cerned about their need to oversee the global marketplace for med- 
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ical products and drugs. 80 percent of the ingredients of active 
drugs come from other countries, about 40 percent of finished 
drugs, about half of medical devices, so they need to do more there 
and also to address drug shortage issues. 

Second area is contract management. We believe the Department 
of Defense has focused more attention at top leadership on con- 
tracting tools and techniques and reducing the risk associated with 
undefinitized contracts where they start contract work without 
having a clear agreement with the contractor or they’re using time 
and materials, which is a risky contract approach, rather than hav- 
ing deliverables. They still have to improve their areas in their ac- 
quisition work force, service acquisitions, and improve their use of 
contracting in the operational environments to support military op- 
erations in theater. 

We are adding two new areas to the high-risk list this year: First 
is VA’s provision of healthcare service for veterans. We’re very con- 
cerned about this area. There are five fundamental problems that 
we’ve identified: ambiguous policies, inconsistent processes, inad- 
equate oversight and monitoring of the activities, IT challenges, in- 
adequate training of staff, and unclear resource needs and alloca- 
tions. Congress has passed legislation recently to give them addi- 
tional $15 billion to help address this problem. That legislation has 
to be implemented properly. We have over 100 recommendations 
that we’ve made to VA that have yet to have been fully imple- 
mented, so this is an area that needs congressional oversight and 
continued attention. 

Second are IT acquisitions and operations across the Federal 
Government. Too often the Federal Government, and we enumerate 
this in our report, there’s a litany of efforts that have failed after 
spending hundreds of millions of dollars or in cases of billions of 
dollars and many years. They’re terminated. There’s a longer list 
of problems where there are cost overruns, schedule slippages, or 
they fail to deliver the promised functionality and make improve- 
ments in the programs that they’re supposed to in delivery of serv- 
ices. Here again, the Congress has passed legislation late last year. 

This committee was instrumental in passing the legislation of 
the Federal Information Technology Reform Act to give CIO’s addi- 
tional authority, put in place better practices to have more dis- 
ciplined approaches to IT management. Here again, just in the last 
5 years alone, we’ve made 737 recommendations. Only 23 percent 
have been fully implemented. So we believe this is a critical area. 

We’re also expanding two areas. In the administration of tax 
area, we have been focused on a tax gap, which at last count was 
$385 billion. We’re expanding that to include identity theft. And 
the IRS was able last year to stop about $24 billion in fraudulent 
returns potentially, but they missed, by their own estimates, about 
$5.8 billion. We’ve got some fixes to this we can talk about in the 
Q&A. 

We’re also expanding cybersecurity and critical infrastructure 
protection to include privacy issues. Initially we designated com- 
puter security across the entire Federal Government, the first time 
we ever did that, in 1997. We added critical infrastructure protec- 
tion, because most of the computer assets were in the private sec- 
tor hands in 2003. Now there’s a lot more incidents involving per- 
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sonally identifiable information. The number of incidents have dou- 
bled over the last 5 years. A privacy law was passed in 1994. It’s 
sorely in need of updating. And we have a number of other rec- 
ommendations to protect this sensitive information. The American 
people deserve for their information to be protected properly while 
we’re addressing the cybersecurity issues. 

I thank you for the opportunity to be here today and look for- 
ward to answering your questions. 

Chairman Chaffetz. Thank you. I appreciate that. 

[Prepared Statement of Mr. Dodaro follows:] 
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[February 2015 


HIGH-RISK SERIES 

An Update 


What GAO Found 

Solid, steady progress has been made in the vast majority of the high-risk areas. 
Eighteen of the 30 areas on the 2013 list at least partially met ail of the criteria for 
removal from the high risk list. Of those, 1 1 met at least one of the criteria for 
remo\^l and partially met all others. Sufficient progress was made to narrow the 
scope of two high-risk issues — Protecting Public Health through Enhanced 
Oversight of Medical Prtxiucts and DOD Contract Management Overall, 
progress has been possible through the concerted actions of Congress, 
leadership and staff in agencies, and the Office of Management and Budget, 

This year GAO is adding 2 areas, bringing the total to 32. 

• Managing Risks and Improving Veterans Affairs (VAj Health Care. GAO 
has reported since 2000 about VA facilities’ failure to provide timely health 
care. In some cases, these delays or VA’s failure to provide care at all have 
reportedly harmed veterans. Although VA has taken actions to address some 
GAO recommendations, more than 100 of GAO’s recommendations have not 
been fully addressed, including recommendations related to the following 
areas; (1) ambiguous policies and inconsistent processes, (2) inadequate 
oversight and accountability. (3) information technology challenges, (4) 
inadequate training for VA staff, and (5) unclear resource needs and 
allocation priorities. The recently enacted Veterans Access, Choice, and 
Accountability Act included provisions to help VA address systemic 
weaknesses. VA must effectively implement the act. 

• Improving the Management of Information Technology (IT) Acquisitions 
and Operations. Congress has passed legislation and the administration 
has undertaken numerous initiatives to better manage IT investments, 
Nonetheless, federal IT investments too frequently fail to be completed or 
incur cost overruns and schedule slippages while contributing little to 
mission-related outcomes. GAO has found that the federal government spent 
billions of dollars on failed and poorly performing IT investments which often 
suffered from ineffective management, such as project planning, 
requirements definition, and program oversight and governance. Over the 
past 5 years, GAO made more than 730 recommendations; however, only 
about 23 percent had been fully implemented as of January 201 5. 

GAO is also expanding two areas due to evolving high-risk issues. 

• Enforcement of Tax Laws. This area is expanded to include IRS’s efforts to 
address tax refund fraud due to identify theft. IRS estimates it paid out S5.8 
billion (the exact number is uncertain) in fraudulent refunds in tax year 201 3 
due to identity theft. This occurs when a thief files a fraudulent return using a 
legitimate taxpayer's identifying infomiation and claims a refund. 

• Ensuring the Security of Federal Information Systems and Cyber 
Critical Infrastructure and Protecting the Privacy of Personally 
Identifiable Information (PH). This risk area is expanded because of the 
challenges to ensuring the privacy of personally identifiable information 
posed by advances in technology. These advances have allowed both 
government and private sector entities to collect and process extensive 
amounts of PH more effectively. The number of reported security incidents 
involving PH at federal agencies has increased dramatically in recent years. 

— United States Government Accountability Office 
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GAO’S 2015 High Risk List 


Strengthening the Foundation for ElYiciency and Effectiveness 



Limiting the Federal Government's Fiscal Exposure by Better Managing Climate Change Risks 


Management of Federal Oil and Gas Resources 


Modernizing the U.S. Financial Regulatory System and the Federal Role in Housing Finance'* 


Restructuring the U.S. Postal Sendee to Achieve Sustainable Financial Viability'' 


Funding the Nation’s Surface Transportation System** 


Strategic Human Capita! Management 


Managing Federal Real Property 


Improving the Management of IT Acquisitions and Operations (new) 

Transforming DOD Program Management 


DOD Approach to Business Transformation 


DOD Business Systems Modernization 


DOD Support infrastructure Management" 


DOD Financial Management 


DOD Supply Chain Management 


DOD Weapon Systems Acquisition 

Ensuring Public Safety and Security 


Mitigating Gaps in Weather Satellite Data 


Strengthening Department of Homeland Security Management Functions 


Establishing Effective Mechanisms for Sharing and Managing Terrorism-R^ated Information to Protect the Homeland 


Ensuring toe Secunty of Federal Information Systems and Cyber Critical Infrastructure and Protecting the Privacy of Personally 
Identifiable Information® 


Ensuring the Effective Protection of Technologies Critical to U.S. National Security Interests® 


Improving Federal Oversight of Food Safety® 


Protecting Public Health through Enhanced Oversight of Medical Products 


Transforming EPA's Processes for Assessing and Controlling Toxic Chemicals® 

Managing Federal Contracting More Effectively 


DOD Contract Management 


DOE’S Contract Management for the National Nuclear Security Administration and Office of Environmental Management 


NASA Acquisition Management 

Assessing the Efficiency and Effectiveness of Tax Law Administration 


Enforcement of Tax Laws 

Modernizing and Safeguarding insurance and Benefit Programs 


Managing Risks and Improving VA Health Care (new) 


improving and Modernizing Federal Disability Programs 


Pension Benefit Guaranty Corporation Insurance Programs® 


Medicare Program® 


Medicaid Program® 


National Flood Insurance Program*" 


Soyrce. GAO |GAO-13-373T 


'Legisfafion is likely to be necessary to effectively address this high-risk area. 
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Chairman Chaffetz, Ranking Member Cummings, and Members of the 
Committee: 

Thank you for the opportunity to discuss our 2015 high-risk update.^ 
Since 1990, we have regularly reported on government operations that 
we have identified as high risk due to their greater vulnerability to fraud, 
waste, abuse, and mismanagement or the need for transformation to 
address economy, efficiency, or effectiveness challenges. Our high-risk 
program, supported by this Committee and the Senate Committee on 
Homeland Security and Governmental Affairs, has brought much-needed 
focus to problems impeding effective government and costing biiiions of 
dollars each year. 

Since our last high-risk update In 2013, solid, steady progress has been 
made in the vast majority of areas that remain on the list. Since 1990, 
more than one-third of the areas previously designated as high risk have 
been removed from the High Risk List because sufficient progress was 
made in addressing the problems identified. Nonetheless, 1 1 issues have 
been on the High Risk List since the 1990s and 6 of these were on our 
original list of 14 areas in 1990. 

Congressional oversight and legislative action have been critical to the 
progress that has been made. Congress passed numerous laws targeting 
both specific problems and the high-risk areas overall. In addition, top 
administration officials have continued to show their commitment to 
ensuring that high-risk areas receive attention and oversight. The Office 
of Management and Budget (0MB) regularly convenes meetings with 
agency leaders and GAO to discuss progress updates on high-risk 
issues. This year, due to significant progress made, we narrowed the 
high-risk designation for two areas— Protecting Public Health Through 
Enhanced Oversight of Medical Products and DOD Contract 
Management. 

We also designated two new high-risk areas this year— Managing Risks 
and Improving VA Health Care and Improving the Management of IT 
Acquisitions and Operations. Lasting solutions to these and the other 30 
high-risk areas offer the potential to save billions of dollars, dramatically 
improve service to the American public, and strengthen public confidence 


■'GAO, High Risk Series: An Update. GAO-1 5-290 (Washington, D.C,: Feb. 11, 2015). 
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and trust in the performance and accountability of our national 
government. 

While there has been notable progress, much remains to be done to 
address the 32 high-risk issues that are currently on our High Risk List, 
Our high risk update report and website provide details for each of these 
issues, describing the nature of the risks, what actions have been taken 
to address them, and what remains to be done to make further progress.^ 
The details in our report, along with successful implementation by 
agencies and continued oversight fay Congress, can form a solid 
foundation for progress to address risks and improve programs and 
operations. 


To determine which federal government programs and functions should 
be added to the High Risk List, we consider whether the program or 
function is of national significance or is key to government performance 
and accountability. Further, we consider qualitative factors, such as 
whether the risk 

• involves public health or safety, service delivery, national security, 
national defense, economic growth, or privacy or citizens’ rights, or 

• could result in significant Impaired service, program failure, injury or 
loss of life, or significantly reduced economy, efficiency, or 
effectiveness. 

In addition, we also review the exposure to loss in quantitative terms such 
as the value of major assets being impaired, revenue sources not being 
realized, or major agency assets being lost, stolen, damaged, or wasted. 
We also consider corrective measures planned or under way to resolve a 
material control weakness and the status and effectiveness of these 
actions. 

This year, we added two new areas, delineated below, to the High Risk 
List based on those criteria. 


New High-Risk 
Areas for 2015 


^GAO’s high risk website, httpV/www.gao.gov/highrisk/. 
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Managing Risks and in response to serious and long-standing problems with veterans’ access 

Improving VA Health Care care, which were highlighted In a series of congressional hearings in 
the spring and summer of 2014, Congress enacted the Veterans Access, 
Choice, and Accountability Act of 2014 (Pub. L. No. 113-146, 128 Stat 
1 754), which provides $1 5 billion in new funding for Department of 
Veterans Affairs (VA) health care. Generally, this law requires VA to offer 
veterans the option to receive hospital care and medical services from a 
non-VA provider when a VA facility cannot provide an appointment within 
30 days, or when veterans reside more than 40 miles from the nearest VA 
facility. Under the law, VA received $10 billion to cover the expected 
increase in utilization of non-VA providers to deliver health care services 
to veterans. The $10 billion is available until expended and is meant to 
supplement VA’s current budgetary resources for medical care. Further, 
the law appropriated $5 billion to increase veterans’ access to care by 
expanding VA’s capacity to deliver care to veterans by hiring additional 
clinicians and improving the physical infrastructure of VA’s facilities. It is 
therefore critical that VA ensures its resources are being used in a cost- 
effective manner to improve veterans’ timely access to health care. 

We have categorized our concerns about VA’s ability to ensure the 
timeliness, cost-effectiveness, quality, and safety of the health care the 
department provides into five broad areas; (1) ambiguous policies and 
inconsistent processes, (2) inadequate oversight and accountability, (3) 
information technology challenges, (4) inadequate training for VA staff, 
and (5) unclear resource needs and allocation priorities. We have made 
numerous recommendations that aim to address weaknesses in VA’s 
management of its health care system— more than 1 00 of which have yet 
to be fully resolved. For example, to ensure that its facilities are carrying 
out processes at the local level more consistently — such as scheduling 
veterans’ medical appointments and collecting data on veteran suicides— 
VA needs to clarify its existing policies. VA also needs to strengthen 
oversight and accountability across its facilities by conducting more 
systematic, independent assessments of processes that are carried out at 
the local level, including how VA facilities are resolving specialty care 
consults, processing claims for non-VA care, and establishing 
performance pay goals for their providers. We also have recommended 
that VA work with the Department of Defense (DOD) to address the 
administrative burdens created by the lack of interoperability between 
their two IT systems. A number of our recommendations aim to improve 
training for staff at VA facilities, to address issues such as how staff are 
cleaning, disinfecting, and sterilizing reusable medical equipment, and to 
more clearly align training on VA’s new nurse staffing methodology with 
the needs of staff responsible for developing nurse staffing plans. Finally, 


Page 3 
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we have recommended that VA improve its methods for identifying VA 
facilities’ resource needs and for analyzing the cost-effectiveness of VA 
health care. 

The recently enacted Veterans Access, Choice, and Accountability Act 
included a number of provisions intended to help VA address systemic 
weaknesses. For example, the law requires VA to contract with an 
independent entity to (1) assess VA’s capacity to meet the current and 
projected demographics and needs of veterans who use the VA health 
care system, (2) examine VA's clinical staffing levels and productivity, and 
(3) review VA's IT strategies and business processes, among other 
things. The new law also establishes a 15-member commission, to be 
appointed primarily by bipartisan congressional leadership, which will 
examine how best to organize the VA health care system, locate health 
care resources, and deliver health care to veterans. It is critical for VA 
leaders to act on the findings of this independent contractor and 
congressional commission, as well as on those of VA’s Office of the 
Inspector General. GAO, and others, and to fully commit themselves to 
developing long-term solutions that mitigate risks to the timeliness, cost- 
effectiveness, quality, and safety of the VA health care system, 

it Is also critical that Congress maintains its focus on oversight of VA 
health care. In the spring and summer of 2014, congressional committees 
held more than 20 hearings to address identified weaknesses in the VA 
health care system. Sustained congressional attention to these Issues will 
help ensure that VA continues to make progress in improving the delivery 
of health care services to veterans. 

We plan to continue monitoring VA’s efforts to improve the timeliness, 
cost-effectiveness, quality, and safety of veterans’ health care. To this 
end, we have ongoing work focusing on topics such as veterans’ access 
to primary care and mental health services; primary care productivity: 
nurse recruitment and retention; monitoring and oversight of VA spending 
on training programs for health care professionals; mechanisms VA uses 
to monitor quality of care; and VA and DOD investments in Centers of 
Excellence— which are intended to produce better health outcomes for 
veterans and service members. 


Page 4 
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Improving the 
Management of IT 
Acquisitions and 
Operations 


Although the executive branch has undertaken numerous initiatives to 
better manage the more than $80 billion that is annually invested in 
information technology (IT), federal IT investments too frequently fail or 
incur cost overruns and schedule slippages while contributing little to 
mission-related outcomes. We have previously testified that the federal 
government has spent billions of dollars on failed IT investments. These 
and other failed IT projects often suffered from a lack of disciplined and 
effective management, such as project planning, requirements definition, 
and program oversight and governance. In many instances, agencies 
have not consistently applied best practices that are critical to 
successfully acquiring IT investments. 

We have identified nine critical factors underlying successful major 
acquisitions that support the objective of improving the management of 
large-scale IT acquisitions across the federal government: (1) program 
officials actively engaging with stakeholders; (2) program staff having the 
necessary knowledge and skills; (3) senior department and agency 
executives supporting the programs; (4) end users and stakeholders 
involved in the development of requirements; (5) end users participating 
In testing of system functionality prior to end user acceptance testing; (6) 
government and contractor staff being stable and consistent; (7) program 
staff prioritizing requirements; (8) program officials maintaining regular 
communication with the prime contractor; and (9) programs receiving 
sufficient funding.^ 

While there have been numerous executive branch initiatives aimed at 
addressing these issues, implementation has been inconsistent. Over the 
past 5 years, we have reported numerous times on shortcomings with IT 
acquisitions and operations and have made about 737 related 
recommendations, 361 of which were to the Office of Management and 
Budget (0MB) and agencies to improve the implementation of the recent 
initiatives and other government-wide, cross-cutting efforts. As of January 
2015, about 23 percent of the 737 recommendations had been fully 
implemented. 

Given the federal government's continued experience with failed and 
troubled IT projects, coupled with the fact that 0MB initiatives to help 


=GAO, Information Technology- Critical Factom Underlying Successful Major Acquisitions, 
GAO-12-7 (Washington, D.C.: Oct. 21, 2011). 
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address such problems have not been fully implemented, the government 
will likely continue to produce disappointing results and will miss 
opportunities to improve IT management, reduce costs, and improve 
services to the public, unless needed actions are taken. Further, it will be 
more difficult for stakeholders, including Congress and the public, to 
monitor agencies’ progress and hold them accountable for reducing 
duplication and achieving cost savings. 

Recognizing the severity of issues related to government-wide 
management of IT, in December 2014 the Federal Information 
Technology Acquisition Reform provisions were enacted as a part of the 
Carl Levin and Howard P. ‘Buck’ McKeon National Defense Authorization 
Act for Fiscal Year 2015. 1 want to acknowledge the leadership of this 
Committee and the Senate Committee on Homeland Security and 
Governmental Affairs In leading efforts to enact this important legislation. 
To help address the management of IT investments, 0MB and federal 
agencies should expeditiously implement the requirements of the 
December 2014 statutory provisions promoting IT acquisition reform,'* 
Doing so should (1) improve the transparency and management of IT 
acquisitions and operations across the government, and (2) strengthen 
the authority of chief information officers to provide needed direction and 
oversight. To help ensure that these improvements are achieved, 
congressional oversight of agencies’ implementation efforts is essential. 

Beyond implementing the recently enacted law, 0MB and agencies need 
to continue to implement our previous recommendations in order to 
improve their ability to effectively and efficiently invest in IT. Several of 
these are critical, such as 

• conducting TechStat reviews for at-risk investments, 

• updating the public version of the IT Dashboard throughout the year, 
and 

• developing comprehensive inventories of federal agencies' software 
licenses. 

To ensure accountability, 0MB and agencies should also demonstrate 
measurable government-wide progress in the following key areas: 


'‘Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 201 5 Pub 
L. No. 113-291. §831 (a) (Dec. 19, 2014). 
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• OMB and agencies should, within 4 years, implement at least 80 
percent of our recommendations related to the management of IT 
acquisitions and operations. 

• Agencies should ensure that a minimum of 80 percent of the 
government’s major acquisitions should deliver functionality every 12 
months. 

• Agencies should achieve no less than 80 percent of the over $6 billion 
In planned PortfolioStat savings and 80 percent of the more than $5 
billion in savings planned for data center consolidation. 


EXDSndinO Hioh-Risk ^ years since the last high-risk update, two areas have expanded in 

m y a scope. Enforcement of Tax laws has been expanded to include IRS's 

ArsaS efforts to address tax refund fraud due to identity theft. Ensuring the 

Security of Federal Information Systems and Cyber Critical Infrastructure 
has been expanded to include the federal government's protection of 
personally identifiable information and is now called Ensuring the Security 
of Federal Information Systems and Cyber Critical Infrastructure and 
Protecting Personally Identifiable information (PH), 


Enforcement of Tax Laws since 1990, we have designated one or more aspects of Enforcement of 
Tax Laws as high risk. The focus of the Enforcement of Tax Laws high- 
risk area is on the estimated $385 billion net tax gap — the difference 
between taxes owed and taxes paid— and IRS's and Congress’s efforts to 
address it. Given current and emerging risks, we are expanding the 
Enforcement of Tax Laws area to include IRS’s efforts to address tax 
refund fraud due to identity theft (IDT), which occurs when an identity thief 
files a fraudulent tax return using a legitimate taxpayer’s identifying 
information and claims a refund. While acknowledging that the numbers 
are uncertain, IRS estimated paying about $5.8 billion in fraudulent IDT 
refunds while preventing $24.2 billion during the 2013 tax filing season. 

While there are no simple solutions to combating IDT refund fraud, we 
have identified various options that could help, some of which would 
require legislative action. Because some of these options represent a 
significant change to the tax system that could likely burden taxpayers 
and impose significant costs to IRS for systems changes, it is important 
for IRS to assess the relative costs and benefits of the options. This 
assessment will help ensure an informed discussion among IRS and 
relevant stakeholders— including Congress— on the best option (or set of 
options) tor preventing IDT refund fraud. 
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Ensuring the Security of 
Federal Information 
Systems and Cyber 
Critical Infrastructure and 
Protecting the Privacy of 
Personally Identifiable 
Information 


Since 1997, we have designated the security of our federal cyber assets 
as a high-risk area. In 2003, we expanded this high-risk area to include 
the protection of critical cyber infrastructure. 

The White Hou^ and federal agencies have taken steps toward 
improving the protection of our cyber assets. However, advances in 
technology v^diich have dramatically enhanced the ability of both 
government and private sector entities to collect and process extensive 
amounts of Personally Identifiable Information (Pll) pose challenges to 
ensuring the privacy of such information. The number of reported security 
incidents involving Pll at federal agencies has increased dramatically in 
recent years. In addition, high-profile Pli breaches at commercial entities 
have heightened concerns that personal privacy is not being adequately 
protected. Finally, both federal agencies and private companies collect 
detailed information about the activities of individuais-raising concerns 
about the potential for significant erosion of personal privacy. We have 
suggested, among other things, that Congress consider amending privacy 
laws to cover all PH collected, used, and maintained by the federal 
government and recommended that the federal agencies we reviewed 
take steps to protect personal privacy and improve their responses to 
breaches of Pll. For these reasons, we added the protection of privacy to 
this high-risk area this year. 


Essential Elements 
for Addressing High- 
Risk Areas 


Our experience with the high-risk series over the past 25 years has 
shown that five broad elements are essential to make progress.® The five 
criteria for removal are as follows; 

• Leadership commitment. Demonstrated strong commitment and top 
leadership support. 

• Capacity. Agency has the capacity (i.e., people and resources) to 
resolve the risk(s). 

• Action plan. A corrective action plan exists that defines the root 
cause and solutions and that provides for substantially completing 
corrective measures, including steps necessary to implement 
solutions we recommended. 


®GAO. Determining Performance and Accountability Challenges and High Risks. 
GAO-01-159SP (Washington, D.C.; November 2000). 
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• Monitoring. A program has been instituted to monitor and 
independently validate the effectiveness and sustainability of 
corrective measures. 

• Demonstrated progress. Ability to demonstrate progress in 
implementing corrective measures and in resolving the high-risk area. 

These five criteria form a road map for efforts to improve and ultimately 
address high-risk issues. Addressing some of the criteria leads to 
progress, v/hile satisfying all of the criteria is central to removal from the 
list. Figure 1 shows the five criteria and examples of actions taken by 
agencies to address the criteria. Throughout my statement and in our 
high-risk update report, we have detailed many actions taken to address 
the high-risk areas aligned with the five criteria as well as additional steps 
that need to be addressed. 


Page 
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Figure 1 : Criteria for Removal from the High Risk Ust and Examples of Actions Leading to Progress 
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High Risk Criteria Examples 


Holding frequent review 
meetir>gs to assess 
status and performance 

Reporting to senior 
managers on program 
progress and potential 
risks 

Tracking prcHjress 
against goals 


Ailocating or reaiiocating 
furrds or staff 
Establishing work 
groups wtth specific 
responsibilities 
Establishing and 
mairrtaining procedures 
or systems 


' identifying «id analyzing 
root causes of problems 
identifyir^ criticai actions 
artd outcon>es to address 
root causes 
Developing mitestones 
and metrics for 
implementing plan goals 
Ensuring mere are 
processes for reporting 
progress 

E&tabtishif>g goals and 
performance measures 


Taking acUons to 
ensure progress {or 
improvements) are 
sustained 

Using data to show 
action on plan 
imptementation 
Sho\Mng high-risk 
Issues are being 
effectivsiy nranaged 
and root causes sro 
being addressed 


Developing 

organteational changes 
and initiatives 
Providing continuing 
oversight and 

Initiating or implementir^ 


Souroa: GAO analysis of agimcWw' Bchon* to e<WraM his^nsk issues end OAO eriierM for iwnov^ from the Rni: list in GAO-01-159SP, j GAaiS^?3T 


in each of our high-risk updates, for more than a decade, we have 
assessed progress to address the five criteria for removing the high-risk 
areas from the list. In this high-risk update, we are adding additional 
clarity and specificity to our assessments by rating each high-risk area's 
progress on the criteria, using the fallowing definiiions: 


• Met Actions have been taken that meet the criterion. There are no 
significant actions that need to be taken to further address this 
criterion. 

• Partially met Some, but not all, actions necessary to meet the 
criterion have been taken. 
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• Not met. Few, if any, acBons towards meeting the criterion ha¥e been 

taken. 

Figure 2 is a visual representation of varying degrees of progress in each 
of the five criteria for a high-risk area. Each point of the star represents 
one of the five criteria for removal from the High Risk List and each ring 
represents one of the three designations: not met. partially met, or met. 


Figure 2: High-Risk Progress Criteria Ratings 



Swrt*:CiAO. i GAai5-373T 


The progress ratings used to address the high-risk 'criteria are an 
important part of our efforts to provide greater transparency and 
specificity to agency leaders as they seek to address high-risk areas, 
Beginning in the spring of 2014 leading up to this high-risk update, we 
met with agency leaders across government to discuss preliminary 
progress ratings. These meetings focused on actions taken and on 
additional actions that need to be taken to address the high-risk issues, 
Several agency leaders told us that the additional clarity provided by the 
progress rating helped them better target their improvement efforts. 


Continued Proaress Wgh-risk update in 2013, there has been solid and steady 

y progress on the vast majority of the 30 high-risk areas from our 201 3 list. 

Progress has been possible through the concerted actions and efforts of 
Congress and the leadership and staff in agencies and OMB. As shown in 
table 1,18 high-risk areas have met or partially met all criteria for removal 
from the list; 1 1 of these areas also fully met at least one criterion. Of the 
1 1 areas that have been on the High Risk List since the 1990s, 7 have at 
least met or partially met all of the criteria for removal and 1 area— 000 
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Contract Management — Is 1 of the 2 areas that has made enough 
progress to remove subcategories of the high-risk area. Overali, 28 high- 
risk areas were rated against the five criteria, totaling a possible 140 high- 
risk area criteria ratings. Of these, 122 (or 87 percent) were rated as met 
or partially met. On the other hand, 13 of the areas have not met any of 
the five criteria; 3 of those — DOD Business Systems Modernization, DOD 
Support Infrastructure Management, and DOD Financial Management- 
have been on the High Risk List since the 1990’s. 


Table 1 ; High-Risk Areas Rated Against Five Criteria for Removal 

Number of 
criteria 

High-risk area 

Met 


Partially 

met Not met 

NASA Acquisition Management® 

3 

2 

0 

Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related Information 
to Protect the Homeland 

2 

3 

0 

Protecting Public Health through Enhanced Oversight of Medical Products 

2 

3 

0 

Strengthening Department of Homeland Security Management Functions 

2 

3 

0 

DOD Contract Management® 

1 

4 

0 

DOD Supply Chain Management® 

1 

4 

0 

DOD Weapon Systems Acquisition® 

1 

4 

0 

Management of Federal Oil and Gas Resources 

1 

4 

0 

Medicare Program® 

1 

4 

0 

Mitigating Gaps In Weaffier Satellite Data 

1 

4 

0 

Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and 
Protecting the Privacy of Personally Identiftabie Information® 

1 

4 

0 

DOD Support Infrastructure Management® 

0 

5 

0 

Ensuring the EffecWve Protection of Technologies Critical to U.S. National Security Interests 

0 

5 

0 

Improving and Modernizing Federal Disability Programs 

0 

5 

0 

Medicaid Program 

0 

5 

0 

Modernizing the U.S, Financial Regulatory System and Federal Role in Housing Finance 

0 

5 

0 

National Flood Insurance Program 

0 

5 

0 

Restructuring the U.S. Postal Service to Achieve Sustainable Financial Viability 

0 

5 

0 

Enforcement of Tax Laws® 

1 

3 

1 

Managing Federal Real Property 

1 

3 

1 

DOD Business Systems Modernization® 

0 


1 

Strategic Human Capital Management 

0 

4 

1 

Transforming EPA’s Processes for Assessing and Controlling Towc Chemicals 

1 

2 

2 
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Number of 
criteria 

High-risk area 

Met 

Partially 

met 

Not met 

DOD Financial Managemenf 

0 

3 

2 

Limiting the Federal Government's Fiscal Exposure by Better Managing Climate Change 
Risks 

0 

3 

2 

Improving Federal Oversight of Food Safety 

0 

3 

2 

DOE'S Contract Management for the National Nuclear Security Administration and Office of 
Environmental Management® 

1 

1 

3 

DOD Approach to Business Transformation 

0 

2 

3 

Funding the Nation’s Surface Transportation System 

N/A 

N/A 

N/A 

Improving the Management of IT Acquisitions and Operations 

N/A 

N/A 

N/A 

Managing Risks and Improving VA Health Care 

N/A 

N/A 

N/A 

Pension Benefit Guaranty Corporation Insurance Programs 

N/A 

N/A 

N/A 


Legend: N/A » Not applicable. 

Sourca, GAO. ! GAO-15-373T 


Note: Four high-risk areas that received a 'not applicable" rating because {1) they are either new to 
our 2015 High-Risk List {Managing Risks and Improving VA Health Care and Improving the 
Management of IT Acquisitions and Operations) or (2) addressing the high risk area primarily involves 
congressional action arx! the high risk criteria and subsequent ratings were developed to reflect the 
status of agencies’ actions and the additional steps they need to take {Funding the Nation's Surface 
Transportation System and Pension BeneTit Guaranty Corporation Insurance Programs). 

*= issue has been on the high risk list since the 19908. 

Throughout the history of the high-risk program, Congress played an 
important role through its oversight and (where appropriate) through 
legislative action targeting both specific problems and the high-risk areas 
overall. Since our last high-risk report, several high-risk areas have 
received congressional oversight and legislation needed to make 
progress in addressing risks. Table 2 provides examples of congressional 
actions and of high-level administration initiatives — discussed in more 
detail throughout our report— that have led to progress in addressing 
high-risk areas. Additional congressional actions and administrative 
initiatives are also included in the individual high-risk areas discussed in 
this report. 
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Table 2: Selected Examples of Congressional Actions and Administration initiatives Leading to Progress on High-Risk Areas 


High-risk area 

Selected example 

Mitigating Gaps in 
Weather Sateiiite Data 

In January 2013, Congress passed foe Disaster Relief Appropriations Act, 2013, which contained $111 
million in funding for satellite gap mitigation prefects. According to National Oceanic and Atmospheric 
Administration officials, this amount was reduced by 5 percent due to budget cuts related to sequestration. 

Protecting Public 

Health through 
Enhanced Oversight of 
Medical Products 

Congress enacted the Dmg Quality and Security Act in November 2013, which contains provisions that 
should help the Food and Drug Adminisbation respond to challenges in two distinct areas that we reported 
on in July 2013: (1) the hazards posed by unsafe drugs from an increasingly complex pharmaceutical supply 
chain that includes rogue Internet pharmades and (2) the public health threat posed by improperly 
compounded drugs. 

Pension Benefit 
Guaranty Corporation 
(PBGC) Insurance 
Programs 

in December 2014, Congress took action to address the growing crisis in foe muitiemployer pension system 
with passage of the Multiemployer Pension Reform Act of 2014. which enacted several reforms 
responsive to our 2013 report on PBGC's multi«nptoyer program. The act provided severely underfunded 
plans, under certain conditions and with the approval of federal regulators, the option to reduce the 
retirement benefits of current retirees to avoid plan insolvency and expand PBGC's ability to intervene when 
plans are in financial distress. While foese reforms are intended to improve the program’s financial condition, 
the future insolvency of the multiemployer program remains likely. In addition, to help address PBGC's 
overall deficit, the Bipartisan Budget Act of 2013 increased premium rates for the single-employer program 
and foe Muitiemployer Pension Reform Act increased premiums for the muitiemployer program. 

Ensuring the Security 
of Federal Information 
Systems and Cyber 
Critical Infrastructure 
and Protecting the 
Privacy of Personally 
Identifiable Inibimation 

in December 2014, five cybersecuhty-related bills were enacted into law, (1) The Federal Information 

Security Modernization Act of 2014 revised the Federal Information Security Management Act of 2002. 
Among other things, it gave the Department of Homeland Security (DHS) responsibilities to assist the Office 
of Management and Budget (OMB) in overseeing civilian agency information security policies and practices 
for information systems. In addition, it requires agencies to include automated toots in periodic testing of 
systems and expands requirements for reporting major incidents and data breach notifications, (2) The 
Cybersecurity Workforce Assessment Act requires DHS to assess its cybersecurity workforce and 
develop a comprehensive strategy to enhance foe readiness, capacity, training, recruitment, and retention of 
its cybersecurity workforce. (3) The Homeland Security Cybersecurity Workforce Assessment Act 
requires DHS to identify cybersecurity positions and the specialty areas of critical need in foe DHS 
cybersecurity workforce. (4) "nie National Cybersecurity Protection Act of 2014 codifies the role of DHS's 
National Cybersecurity and Communications Integration Center, a 24x7 cyber situational awareness, incident 
response and management center that is a national nexus of cyber and communications integration for the 
federal government, intelligence community, and law enforcement. (5) The Cybersecurity Enhancement 

Act of 2014 authorizes the Department of Commerce, through the National Institute of Standards and 
Technology, to facilitate and support the development of voluntary standards to reduce cyber risks to critical 
infrastructure. The law also requires the Office of Science and Technology Policy in the Executive Office of 
the President to facilitate agencies' development of a federal cybersecuri^ research and development plan. 

DOD Approach to 

Business 

Transformation 

The Carl Levin and Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015 
converted the Deputy Chief Management Officer to the Under Secretary of Defense for Business 

Management and information. The Under Secretary of Defense for Business Management and Information 
will assist the Deputy Secretary of Defense in his role as foe Chief Management Officer, The Under Secretary 
of Defense for Business Management and Information will also serve as the Chief Information Officer and 
Performance Improvement Officer for the Department of Defense, These changes will take effect on 

February 1, 2017, 
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High-risk area 

Selected example 

DOD Financiai 
Management 

The National Defense Authorization Act<NDAA) for Fiscal Year 2013 required the Financial improvement 
and Audit Readiness Plan to state the actions taken to ensure validation of the audit readiness of the 
Department of Defense (DOD) Statement of Budgetary Resources no later than September 30, 2014. 

Although the November 2014, Financial Improvement and Audit Readiness Plan Status Report 
acknowledges that DOD has not met that date, Congress' action to set a specific date for the goal of DOD 
audit readiness is important for holding DOD accountable for progress. Congress further strengthened 
accountability in the NDAA for Fiscal Year 2014 fay requiring a full audit of DOD's fiscal year 2018 financiai 
statements and for those results to be sufcxnitted to Congress no later than March 31 , 201 9. 

Strengthening 
Department of 
Homeland Security 
Management 
Functions 

The Department of Homeland Seojrity (DHS) has established various initiatives collectively intended to 
improve its unity of effort by, among other things, improving the department’s planning, programming, 
budgeting, and execution processes through sb^ngteened deparbnentai structures and increased capability. 

In addition, DHS has increased component-level acquisition capability by. among other things, initiating 
monthly Component Acquisition Executive staff fbnjms to provide guidance and share best practices. DHS 
has also strengthened its enterprise ardiitecture program (or blueprint) to guide and constrain information 
technology acquisitions and has obtained a clean opinion on its financial statements for 2 consecufive years, 
fiscal years 2013 and 2014. 

Improving and 
Modernizing Federal 
Disability Programs 

The administration has set goals for hiring f^ople with disabilities and launched a training course in July 

2014 to help federal agencies hire, retain, and advance employees with disabilities. The administration 
continues to track— and has made some progress increasing — employment for people with disabilities at 
federal agencies. 

Source: GAO. I GAO-15-373T 


Narrowing High Since our 2013 update, sufficient progress has been made to narrow the 

Risk Areas scope of the following two areas. 


Protecting Public Health 
through Enhanced Oversight 
of Medical Products 


Protecting Publit Health through 
Enhanced Oversight of Medical 
Products 


Source: GAO analysis, i 2015 High Ritk l.ist GAO-1S-373T 


Our work has identified the following high-risk issues related to the Food 
and Drug Administration's (FDA) efforts to oversee medical products: (1) 
oversight of medical device recalls, (2) implementation of the Safe 
Medical Devices Act of 1990, (3) the effects of globalization on medical 
product safety, and (4) shortages of medically necessary drugs. We 
added the oversight of medical products to our High Risk List in 2009. 
Since our 2013 high-risk update, FDA has made substantial progress 
addressing the first two areas; therefore, we have narrowed this area to 
remove these issues from our High Risk List. However, the second two 
issues, globalization and drug shortages, remain pressing concerns. 

FDA has greatly improved its oversight of medical device recalls by fully 
implementing all of the recommendations made in our 201 1 report on this 
topic. Recalls provide an important tool to mitigate serious health 
consequences associated with defective or unsafe medical devices. We 
found that FDA had not routinely analyzed recall data to determine 
whether there are systemic problems underlying trends in device recalls. 
We made specific recommendations to the agency that it enhance its 
oversight of recalls. FDA is fully implementing our recommendations and 
has developed a detailed action plan to improve the recall process. 
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analyzed 10 years of medical device recall trend data, and established 
explicit criteria and set thresholds for determining whether recalling firms 
have performed effective corrections or removals of defective products. 
These actions have addressed this high-risk issue. 

The Safe Medical Devices Act of 1990 requires FDA to determine the 
appropriate process for reviewing certain high-risk devices — either 
reclassifying certain high-risk medical device types to a lower-risk class or 
establishing a schedule for such devices to be reviewed through its most 
stringent premarket approval process. We found that FDA's progress was 
slow and that it had never established a timetable for its reclassification or 
re-review process. As a result, many high-risk devices — including device 
types that FDA has identified as implantable, life sustaining, or posing a 
significant risk to the health, safety, or welfare of a patient — still entered 
the market through FDA's less stringent premarket review process. We 
recommended that FDA expedite its implementation of the act. Since 
then, FDA has made good progress and began posting the status of its 
reviews on its website. FDA has developed an action plan with a goal of 
fully implementing the provisions of the act by the second quarter of 
calendar year 201 5. While FDA has more work to do. it has made 
sufficient progress to address this high-risk issue. 


DOD Contract Management 



Source; GAO snu^is. 1 2015High Risk Li5tGAO-IS-373T 


Based on our reviews of DOD's contract management activities over 
many years, we placed this area on our High Risk List in 1992. For the 
past decade, our work and that of others has identified challenges DOD 
faces within four segments of contract management: (1) the acquisition 
workforce, (2) contracting techniques and approaches, (3) service 
acquisitions, and (4) operational contract support. DOD has made 
sufficient progress In one of the four segments— Its management and 
oversight of contracting techniques and approaches— to warrant its 
removal as a separate segment within the overall DOD contract 
management high-risk area. Significant challenges still remain in the 
other three segments. 

We made numerous recommendations to address the specific issues we 
identified. DOD leadership has generally taken actions to address our 
recommendations. For example, DOD promulgated regulations to better 
manage its use of time-and-materiais contracts and undefinitized contract 
actions (which authorize contractors to begin work before reaching a final 
agreement on contract terms). In addition, 0MB directed agencies to take 
action to reduce the use of noncompetitive and time-and-materiais 
contracts. Similarly, Congress has enacted legislation to limit the length of 
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noncompetitive contracts and require DOD to issue guidance to link 
award fees to ao^uisition outcomes. 

Over the past several years, DOD's top leadership has taken significant 
steps to plan and monitor progress in the management and oversight of 
contracting techniques and approaches. For example, through its Better 
Buying Power initiatives DOD leadership identified a number of actions to 
promote effective competition and to better utilize specific contracting 
techniques and approaches. In that regard, in 2010 DOD issued a policy 
containing new requirements for competed contracts that received only 
one offer — a situation 0MB has noted deprives agencies of the ability to 
consider alternative solutions in a reasoned and structured manner and 
which DOD has termed “ineffective competition.” These changes were 
codified in DOD’s acquisition regulations in 2012. In May 2014, we 
concluded that DOD's regulations help decrease some of the risks of one 
offer awards, but also that DOD needed to take additional steps to 
continue to enhance competition, such as establishing guidance for when 
contracting officers should assess and document the reasons only one 
offer was received. DOD concurred with the two recommendations we 
made in our report and has since implemented one of them. 

DOD also has been using its Business Senior Integration Group (BSIG) — 
an executive-level leadership forum — ^for providing oversight in the 
planning, execution, and implementation of these initiatives. In March 
2014, the Director of the Office of Defense Procurement and Acquisition 
Policy presented an assessment of DOD competition trends that provided 
information on competition rates across DOD and for selected commands 
within each military department and proposed specific actions to improve 
competition. The BSIG forum provides a mechanism by which DOD can 
address ongoing and emerging weaknesses in contracting techniques 
and approaches and by which DOD can monitor the effectiveness of its 
efforts. Further, in June 2014, DOD issued its second annual assessment 
of the performance of the defense acquisition system. The assessment, 
included data on the system’s competition rate and goals, assessments of 
the effect of contract type on cost and schedule control, and the impact of 
competition on the cost of major weapon systems. 

An institution as large, complex, and diverse as DOD. and one that 
obligates hundreds of billions of dollars under contracts each year, will 
continue to face challenges with its contracting techniques and 
approaches. We will maintain our focus on identifying these challenges 
and proposing solutions. However, at this point DOD's continued 
commitment and demonstrated progress in this area— including the 
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establishment of a framework by which DOD can address ongoing and 
emerging issues associated with the appropriate use of contracting 
techniques and approaches — provide a sufficient basis to remove this 
segment from ttie DOD contract management high-risk area. 


Progress in Selected in addition to the two areas that we narrowed — Protect/'ng Public Health 

High-Risk Areas through Enhanced Oversight of Medical Products and DOD Contract 

Management — nine other areas met at least one of the criteria for 
removal from the High Risk List and were rated at least partially met for 
al! four of the remaining criteria. These areas serve as examples of solid 
progress made to address high-risk issues through implementation of our 
recommendations and through targeted corrective actions. Further, each 
example underscores the importance of high-level attention given to high- 
risk areas within the context of our criteria by the administration and by 
congressional action. To sustain progress in these areas and to make 
progress in other high-risk areas — including eventual removal from the 
High Risk List — focused leadership attention and ongoing oversight will 
be needed. 


NASA Acquisition 
Management 



Suiiree; GAO analysis. 1 20'IS Mign Risk List GAO-15.373r 


The National Aeronautics and Space Administration’s (NASA) acquisition 
management was included on the original High Risk List in 1990. NASA’s 
continued efforts to strengthen and integrate its acquisition management 
functions have resulted in the agency meeting three criteria for removal 
from our High Risk List — leadership commitment, a corrective action plan, 
and monitoring. For example, NASA has completed the implementation of 
its corrective action plan, which was managed by the Deputy 
Administrator, with the Chief Engineer, the Chief Financial Officer, and 
the agency's Associate Administrator having led implementation of the 
individual initiatives.’ The plan identified metrics to assess the progress of 
implementation, which NASA continues to track and report semi-annuatiy. 
These metrics include cost and schedule performance indicators for 
NASA’s major development projects. We have found that NASA's 
performance metrics generally reflect improved performance. For 
example, average cost and schedule growth for NASA's major projects 
has declined since 201 1 and most of NASA's major projects are tracking 
metrics, which we recommended in 201 1 to better assess design stability 


’NASA's Associate Administrator oversees the agency’s Office of Evakiation, which 
includes divisions responsible for cost a,nalysis and independent program evaluation 
respectively. 
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and decrease risk. In addition, NASA has taken action in response to our 
recommendations to improve the use of earned value management— a 
tool designed to help project managers monitor progress — such as by 
conducting a gap analysis to determine whether each center has the 
requisite skills to effectively utilize earned value management. 

These actions have helped NASA to create better baseline estimates and 
track performance so that NASA has been able to launch more projects 
on time and within cost estimates. However, we found that NASA needs 
to continue its efforts to increase agency capacity to address ongoing 
issues through additional guidance and training of personnel. Such efforts 
should help maximize improvements and demonstrate that the improved 
cost and schedule performance will be sustained, even for the agency's 
most expensive and complex projects. 

Recently, a few of NASA’s major projects are rebaselining their cost, 
schedule, or both in light of management and technical issues, which is 
tempering the progress of the whole portfolio, in addition, several of 
NASA’s largest and most complex projects, such as NASA’s human 
spaceflight projects, are at critical points in implementation. We have 
reported on several challenges that may further impact NASA’s ability to 
demonstrate progress in improving acquisition management'. 


'See James Webb Space Telescope: Pmiect Facing Increased Schedule Rish with 
Significant Work Remaining. GAO-15-100. Washington, D-C.; December 15, 2014; NASA: 
Actions Needed to Improve Transparency and Assess Long-Term Affordability of Human 
Exploration Programs. GAO-14-385, Washington, D.C.: May 8, 2014; and NASA- 
Assessments of Selected Large-Scale Projects. GAO-14-336SP. Washington D C Acril 
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Establishing Effective 
Mechanisms for Sharing and 
Managing Terrorism-Related 
Information to Protect the 
Homeland 



SOUTCS: GAO snalysra. j 2015HiHhRlsXL!BIQAO4S-373T 


The federal government has made significant progress in promoting the 
sharing of information on terrorist threats since we added this issue to the 
High Risk List in 2003. As a result, the federal government has met our 
criteria for leadership commitment and capacity and has partiaiiy met the 
remaining criteria for this high-risk area. Significant progress was made in 
this area by developing a more structured approach to achieving the 
information Sharing Environment (Environment) and by defining the 
highest priority initiatives to accomplish. In December 2012, the President 
released ttie NaBonal Strategy for Information Sharing and Safeguarding 
(Strategy), which provides guidance on the implementation of policies, 
standards, and technologies that promote secure and responsible 
national security information sharing. In 2013, in response to the Strategy, 
the Program Manager for the Environment released the Strategic 
implementation Plan for the National Strategy for information Sharing and 
Safeguarding (Implementation Plan). 

The Implementation Plan provides a roadmap for the implementation of 
the priority objectives in the Strategy. The Implementation Plan also 
assigns stewards to coordinate each priority objective— in most cases, a 
senior department official— and provides time frames and milestones for 
achieving the outcomes in each objective. Adding to this progress is the 
work the Environment has done to address our previous 
recommendations. In our 201 1 report on the Environment, we 
recommended that key departments better define incremental costs for 
information sharing activities and establish an enterprise architecture 
management plan. Since then, senior officials in each key department 
reported that any incremental costs related to implementing the 
Environment are now embedded within each department’s mission 
activities and operations and do not require separate funding. Further, the 
2013 Implementation Plan includes actions for developing aspects of an 
architecture for the Environment. In 2014, the program manager issued 
the Information Interoperability Framework, which begins to describe key 
elements intended to help link systems across departments to enable 
information sharing. 


Going forward, in addition to maintaining leadership commitment and 
capacity, the program manager and key departments will need to 
continue working to address remaining action items informed by our five 
high-risk criteria, thereby helping to reduce risks and enhance the sharing 
and management of terrorism-related information. 
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The Department of Homeland Security (DHS) has continued efforts to 
strengthen and integrate its management functions since those issues 
were placed on ttie High Risk List in 2003. These efforts resulted in the 
department meeting two criteria for removal from the High Risk List 
(leadership commitment and a corrective action plan) and partially 
meeting the remaining three criteria (capacity, a framework to monitor 
progress, and demonstrated, sustained progress). DHS's top leadership, 
including the Secretary and Deputy Secretary of Homeland Security, have 
continued to demonstrate exemplary commitment and support for 
addressing the department's management challenges. For instance, the 
Department’s Under Secretary for Management and other senior 
management officials have routinely met with us to discuss the 
department's plans and progress, which helps ensure a common 
understanding of the remaining work needed to address our high-risk 
designation. 

In April 2014, the Secretary of Homeland Security issued Strengthening 
Departmental Unity of Effort, a memorandum committing the agency to, 
among other things, improving DHS's planning, programming, budgeting, 
and execution processes through strengthened departmental structures 
and increased capability, in addition, DHS has continued to provide 
updates to the report Integrated Strategy for High Rish Management, 
demonstrating a continued focus on addressing its high-risk designation. 
The integrated strategy includes key management initiatives and related 
corrective action plans for achieving 30 actions and outcomes, which we 
identified and DHS agreed are critical to addressing the challenges within 
the department’s management areas and to integrating those functions 
across the department. Further, DHS has demonstrated progress to fully 
address nine of these actions and outcomes, five of which it has 
sustained as fully implemented for at least 2 years. For example, DHS 
fully addressed two outcomes because it received a clean audit opinion 
on its financial statements for 2 consecutive fiscal years, 2013 and 2014. 
In addition, the department strengthened its enterprise architecture 
program (or technology blueprint) to guide IT acquisitions by. among 
other things, largely addressing our prior recommendations aimed at 
adding needed architeclural depth and breadth. 


DHS needs to continue implementing its Integrated Strategy for High Risk 
Management and show measurable, sustainable progress in 
implementing its key management initiatives and corrective actions and 
achieving outcomes. In doing so, it will be important for DHS to identify 
and work to mitigate any resource gaps, and prioritize initiatives as 
needed to ensure it can implement and sustain its corrective actions. 
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closely track and independently validate the effectiveness and 
sustainability of Its con&Awe actions and make midcourse adjustments 
as needed; and make continued progress in achieving the 21 actions and 
outcomes it has not fully addressed, and demonstrate that systems, 
personnel, and policies are in place to ensure that progress can be 
sustained overtime 


DOD Supply Chain 
Management 



Sourcs: GAO analysis, t 2C11S HtghRlsli U«1 GAO-IS-SW 


DOD supply chain management is one of the six issues that has been on 
the High Risk List since 1990. DOD has made progress in addressing 
weaknesses in all three dimensions of its suppiy chain management 
areas: inventory management, materiel distribution, and asset visibility. 
With respect to Inventory management, DOD has demonstrated 
considerable progress in implementing its statutorily mandated corrective 
action plan. This plan is intended to reduce excess inventory and improve 
inventory management practices. Additionally, DOD has established a 
performance management framework, including metrics and milestones, 
to track the implementation and effectiveness of its corrective action plan 
and has demonstrated considerable progress in reducing its excess 
inventory and improving its inventory management. For example, DOD 
reported that its percentage of on-order excess inventory dropped from 
9.5 percent in fiscal year 2009 to 7.9 percent in fiscal year 2013. DOD 
calculates the percentage by dividing the amount of on-order excess 
inventory by the total amount of on-order inventory, In response to our 
2012 recommendations on the implementation of the plan, DOD 
continues to re-examine its goals for reducing excess inventory, has 
revised its goat for reducing on-hand excess inventory (it achieved its 
original goal early), and is in the process of institutionalizing its inventory 
management metrics in policy. 


DOD has also made progress In addressing its materiel distribution 
challenges. Specifically, DOD has implemented, or is implementing, 
distribution-related initiatives that could serve as a basis for a corrective 
action plan. For example. DOD developed its Defense Logistics Agency 
Distribution Effectiveness Initiative, formerly called Strategic Network 
Optimization, to improve logistics efficiencies in DOD’s distribution 
network and to reduce transportation costs, This initiative accomplishes 
these objectives by storing materiel at strategically located Defense 
Logistics Agency supply sites. 


Further, DOD has demonstrated significant progress in addressing its 
asset visibility weaknesses by taking steps to implement our February 
2013 recommendation that DOD develop a strategy and execution plans 
that contain all the elements of a comprehensive strategic plan, including, 
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among other elements, performance measures for gauging results. The 
National Defense Authorization Act for Fiscal Year 2014 required that 
DOD’s strategy and implementation plans for asset visibility, which were 
in development, incorporate, among other things, the missing elements 
that we identified. DOD’s January 2014 Strategy for Improving DOD 
Asset Visibility represents a corrective action plan and contains goals and 
objectives — as well as supporting execution plans — outlining specific 
objectives intended to improve asset visibility. DOD’s Strategy calls for 
organizations to identify at least one outcome or key performance 
Indicator for assessing performance in implementing the initiatives 
intended to improve asset visibility. DOD has also established a structure, 
including Its Asset Visibility Working Group, for monitoring implementation 
of its asset visibility improvement initiatives. 

Moving forward, the removal of DOD supply chain management from 
GAO’S High Risk List will require DOD to take several steps. For 
inventory management, DOD needs to demonstrate sustained progress 
by continuing to reduce its on-order and on-hand excess inventory, 
developing corrective actions to improve demand forecast accuracy, and 
implementing methodologies to set inventory levels for reparable items 
(i.e., items that can be repaired) with low or highly variable demand. For 
materiel distribution, DOD needs to develop a corrective action plan that 
includes reliable metrics for, among other things, identifying gaps and 
measuring distribution performance across the entire distribution pipeline. 
For asset visibility, DOD needs to (1) specify the linkage between the 
goals and objectives in Its Strategy and the initiatives intended to 
Implement it and (2) refine, as appropriate, its metrics to ensure they 
assess progress towards achievement of those goals and objectives. 
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DOD Weapon Systems 
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DOD weapon systems acquisition has also been on the High-Risk List 
since 1990. Congress and DOD have long sought to improve the 
acquisition of major weapon systems, yet many DOD programs are still 
falling short of cost, schedule, and performance expectations. The results 
are unanticipated cost overruns, reduced buying power, and in some 
cases delays or reductions in the capability ultimately delivered to the 
warfighter. 

Our past work and prior high-risk updates have identified multiple 
weaknesses in the way DOD acquires the weapon systems it delivers to 
the warfighter and we have made numerous recommendations on how to 
address these weaknesses. Recent actions taken by top leadership at 
DOD indicate a firm commitment to improving the acquisition of weapon 
systems as demonstrated by the release and implementation of the 
Under Secretary of Defense for Acquisition, Technology, and Logistics' 
“Better Buying Power’ initiatives. These initiatives include measures such 
as setting and enforcing affordability constraints, instituting a long-term 
investment plan for portfolios of weapon systems, implementing “should 
cost" management to control contract costs, eliminating redundancies 
within portfolios, and emphasizing the need to adequately grow and train 
the acquisition workforce. 


DOD also has made progress in its efforts to assess the root causes of 
poor weapon system acquisition outcomes and in monitoring the 
effectiveness of its actions to improve its management of weapon 
systems acquisition. Through changes to acquisition policies and 
procedures, DOD has made demonstrable progress and, if these reforms 
are fully implemented, acquisition outcomes should Improve. At this point, 
there is a need to build on existing reforms by tackling the incentives that 
drive the process and behaviors. In addition, further progress must be 
made in applying best practices to the acquisition process, attracting and 
empowering acquisition personnel, reinforcing desirable principles at the 
beginning of the program, and improving the budget process to allow 
better alignment of programs and their risks and needs. While DOD has 
made real progress on the issues we have identified in this area, with the 
prospect of slowly growing or flat defense budgets for years to come, the 
department must continue this progress and get belter returns on its 
weapon system investments than it has in the past. 

DOD has made some progress in updating its policies to enable better 
weapon systems outcomes. However, even with this call for change we 
remain concerned about the full implementation of proposed reforms as 
DOD has, in the past, failed to convert policy into practice. In addition, 
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although we reported in March 2014 on the progress many DOD 
programs are making in reducing their cost in the near term, individual 
weapon programs are still failing to conform to best practices for 
acquisition or to implement key acquisition reforms and initiatives that 
could prevent long-term cost and schedule growth.® 

We added this high-risk area in 1997 and expanded it this year to include 
protection of Pll. Although significant challenges remain, the federal 
government has made progress toward improving the security of its cyber 
assets. For example. Congress, as part of its ongoing oversight, passed 
five bills, which became law, for improving the security of cyber assets. 
The first, The Federal Information Security Modernization Act of 2014,® 
revises the Federal Information Security Management Act of 2002’° and 
clarifies roles and responsibilities for overseeing and implementing 
federal agencies' information security programs. The second law, the 
Cybersecurity Workforce Assessment Act, ' ’ requires DHS to assess its 
cybersecurity workforce and develop a strategy for addressing workforce 
gaps. The third, the Homeland Security Cybersecurity Workforce 
Assessment Act,'® requires DHS to identify all of its cybersecurity 
positions and calls for the department to identify specialty areas of critical 
need in its cybersecurity workforce. The fourth, the National 
Cybersecurity Protection Act of 2014,’° codifies the role of DHS' National 
Cybersecurity and Communications Integration Center as the nexus of 
cyber and communications integration for the federal government, 
intelligence community, and law enforcement. The fifth, the Cybersecurity 
Enhancement Act of 2014, authorizes the Department of Commerce, 
through the National Institute of Standards and Technology, to facilitate 
and support the development of voluntary standards to reduce cyber risks 
to critical infrastructure. 


°GAO, Defense Acquisitions: Assessments of Selected Weapon Programs, 
GAO-14-340SP (Washington, D.C.: Mar. 31. 2014). 

"Pub. L. No. 113-283 (Dec. 18, 2014). 

'"Title III, E-Govemment Aotof2002, Pub. L. No, 107-347 (Dec. 17, 2002). 
"Pub. L, No. 113-246 (Dec 18 2014). 

'®Sec. 4, Pub. L. No, 113-277 (Deo. 18 2014). 

’¥ub. L. No, 113-282 (Dec. 18, 2014), 

’“'Pub. L No- 113-274 (Dec, 18, 2014). 
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The White House and senior leaders at DHS have also committed to 
securing critical cyber assets. Specifically, the President has signed 
legislation and issued strategy documents for improving aspects of 
cybersecurity, as well as an executive order and a policy directive for 
improving the security and resilience of critical cyber Infrastructure, in 
addition. DHS and Its senior leaders have committed time and resources 
to advancing cybersecurity efforts at federal agencies and to promoting 
critical Infrastructure sectors' use of a cybersecurity framework. 

However, securing cyber assets remains a challenge for federal 
agencies. Continuing challenges, such as shortages in qualified 
cybersecurity personnel and effective monitoring of, and continued 
weaknesses In, agencies' infomiation security programs need to be 
addressed. 

Until the White House and executive branch agencies implement the 
hundreds of recommendations that we and agency inspectors general 
have made to address cyber challenges, resolve identified deficiencies, 
and fully implement effective security programs and privacy practices, a 
broad array of federal assets and operations may remain at risk of fraud, 
misuse, and disruption, and the nation’s most critical federal and private 
sector infrastructure systems will remain at increased risk of attack from 
adversaries. In addition to the recently passed laws addressing 
cybersecurity and the protection of critical infrastructures, Congress 
should also consider amending applicable laws, such as the Privacy Act 
and E-Government Act, to more fully protect Pll collected, used, and 
maintained by the federal government. 


Page 26 


GAO-1 5-373T 



34 


Management of Federal Oil 
and Gas Resources 



Soui>--«: GAOHnalysla. I 2015 H^iiRtak. List GAO‘16-373T 


The Department of the Interior's (interior) continued efforts to improve its 
management of federal oil and gas resources since we placed these 
issues on the High Risk List in 201 1 have resulted in the department 
meeting one of the criteria for removal from our High Risk List — 
leadership commitment. Interior has implemented a number of strategies 
and corrective measures to help ensure the department collects its share 
of revenue from oil and gas produced on federal lands and waters. 
Additionally, Interior is developing a comprehensive approach to address 
its ongoing human capital challenges. In November 2014, Interior senior 
leaders briefed us on the department’s commitment to address the high- 
risk issue area by describing the following corrective actions. 

• To help ensure Interior collects revenues from oil and gas produced 
on federal lands and waters. Interior has taken steps to strengthen its 
efforts to improve the measurement of oil and gas produced on 
federal leases by ensuring a link between what happens in the field 
(measurement and operations) and what is reported to Interior's 
Office of Natural Resources Revenue or ONRR (production volumes 
and dispositions). To ensure that federal oil and gas leases are 
inspected, Interior is hiring inspectors and engineers with an 
understanding of metering equipment and measurement accuracy. 
The department has several efforts under way to assure that oil and 
gas are accurately measured and reported. For example, ONRR 
contracted for a study to automate data collection from production 
metering systems. In 2012, the Bureau of Safety and Environmental 
Enforcement hired and provided measurement training to a new 
measurement inspection team. To better ensure a fair return to the 
federal government from leasing and production activities from federal 
offshore leases, Interior raised royalty rates, minimum bids, and rental 
rates. For onshore federal leases, according to interior’s November 
2014 briefing document, ONRR’s Economic Analysis Office will 
provide the Bureau of Land Management (BLM) monthly analyses of 
global and domestic market conditions as BLM initiates a rulemaking 
effort to provide greater flexibility in setting onshore royalty rates. 


• To address the department’s ongoing human capital challenges, 
interior is working with the Office of Personnel Management to 
establish permanent special pay rates for critical energy occupations 
in key regions, such as the Gulf of Mexico. Bureau managers are 
being trained on the use of recruitment, relocation, and retention 
incentives to improve hiring and retention. Bureaus are impiemenfing 
or have implemented data systems to support the accurate capture of 
hiring data to address delays in the hiring process. Finally, interior is 
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developing strategic workforce plans to assess the critical skills and 
competencies needed to achieve current and future program goals. 


To address its revenue coilection challenges. Interior will need to identify 
the staffing resources necessary to consistently meet its annual goals for 
oil and gas production verification inspections. Interior needs to continue 
meeting its time frames for updating regulations related to oil and gas 
measurement and onshore royalty rates. It will also need to provide 
reasonable assurance that oil and gas produced from federal leases is 
accurately measured and that the federal government is getting an 
appropriate share of oil and gas revenues. 


To address Its human capital challenges, Interior needs to consider how it 
will address staffing shortfalls over time in view of continuing hiring and 
retention challenges, it will also need to implement its plans to hire 
additional staff with expertise in inspections and engineering. Interior 
needs to ensure that it collects and maintains complete and accurate data 
on hiring times— such as the time required to prepare a job description, 
announce the vacancy, create a list of qualified candidates, conduct 
interviev/s, and perform background and security checks— to effectively 
implement changes to expedite its hiring process, 


Medicare Improper Payments 
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The Centers for Medicare & Medicaid Services (CMS), in the Department 
of Health and Human Services (HHS), administers Medicare, which has 
been on the High Risk List since 1990.’® CMS has continued to focus on 
reducing improper payments in the Medicare program, which has resulted 
in the agency meeting our leadership commitment criterion for removal 
from the High Risk List and partially meeting our other four criteria. HHS 
has demonstrated top leadership support for addressing this risk area by 
continuing to designate "strengthened program integrity through improper 
payment reduction and fighting fraud" an HHS strategic priority and, 
through its dedicated Center for Program Integrity, CMS has taken 
multiple actions to improve in this area. For example, as we 
recommended in November 2012, CMS centralized the development and 
implementation of automated edits — prepayment controls used to deny 
Medicare claims that should not be paid— based on a type of national 


®The Medicare program has been on the High Risk List since 1 990 but given the 
importance of sustained Medicare integrity to protectino federal dollars, we are focusing 
this high-risk rating and assessment on CMS's efforts to reduce Medicare Improper 
paymente- 
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policy called national coverage determinations. Such action will ensure 
greater consistency In paying oniy those Medicare claims that are 
consistent national policies. 

In addition. CMS has taken action to implement provisions of the Patient 
Protection and Affordable Care Act that Congress enacted to combat 
fraud, v/aste, and abuse in Medicare. For instance, in March 2014, CMS 
awarded a contract to a Federal Bureau of Investigation-approved 
contractor that will enable the agency to conduct fingerprint-based 
criminal history checks of high-risk providers and suppliers. This and 
other provider screening procedures will help block the enrollment of 
entities intent on committing fraud. 

CMS made positive strides, but more needs to be done to fully meet our 
criteria. For example, CMS has demonstrated leadership commitment by 
taking actions such as strengthening provider and supplier enrollment 
provisions, and improving its prepayment and postpayment claims review 
process in the fee-for-service (FFS) program, However, ail parts of the 
Medicare program are on the Office of Management and Budget's list of 
high-error programs, suggesting additional actions are needed. By 
implementing our open recommendations, CMS may be able to reduce 
improper payments and make progress toward fulfilling the four 
outstanding criteria to remove Medicare improper payments from our 
High Risk List. The following summarizes open recommendations and 
procedures authorized by the Patient Protection and Affordable Care Act 
that CMS should implement to make progress toward fulfilling the four 
outstanding criteria to remove Medicare improper payments from our 
High Risk List. CMS should 

• require a surety bond for certain types of at-risk providers and 
suppliers; 

• publish a proposed rule for increased disclosures of prior actions 
taken against providers and suppliers enrolling or revalidating 
enrollment In Medicare, such as whether the provider or supplier has 


'^Medicare consists of four parts. Parts A and B are known as Medicare FFS, Part A 
covere hospital and other inpatient stays and Part B covers hospital outpatient, physician, 
and otfier services. Part C. also known as Medicare Advantage, is the private plan 
alternative to Medicare FFS under which beneficiaries receive benefits through private 
health plans. Part D is the outpatient prescription drug benefit. 
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been subject to a payment suspension from a federal health care 
program; 

• establish core elements of compliance programs for providers and 
suppliers; 

• improve automatecj edits that identify services billed in medically 
unlikely amounts; 

• develop performance measures for the Zone Program integrity 
Contractors who explicitly link their work to the agency's Medicare 
FFS program integrity performance measures and improper payment 
reduction goals; 

• reduce differences between contractor postpayment review 
requirements, when possible: 

• monitor the database used to track Recovery Auditors’ activities to 
ensure that all postpayment review contractors are submitting 
required data and that the data the database contains are accurate 
and complete; 

• require Medicare administrative contractors to share information about 
the underlying policies and savings related to their most effective 
edits; and 

• efficiently and cost-effectively identify, design, develop, and 
implement an Information technology solution that addresses the 
removal of Social Security numbers from Medicare beneficiaries’ 
health insurance cards. 
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The National Oceanic and Atmospheric Administration (NOAA) has made 
progress toward improving its ability to mitigate gaps in weather satellite 
data since the issue was placed on the High Risk List in 2013. NOAA has 
demonstrated leadership on both its polar-orbiting and geostationary 
sateiiite programs by making decisions on how it plans to mitigate 
anticipated and potential gaps, and in making progress on multiple 
mitigation-related activities. In addition, the agency implemented our 
recommendations to improve its polar-orbiting and geostationary satellite 
gap contingency plans. Specifically, In September 2013, we 
recommended that NOAA establish a comprehensive contingency plan 
for potential polar satellite data gaps that was consistent with contingency 
planning best practices. In February 2014, NOAA issued an updated plan 
that addressed many, but not all, of the best practices. For example, the 
updated plan includes additional contingency alternatives; accounts for 
additional gap scenarios; identifies mitigation strategies to be executed; 
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and identifies specific activities for implementing those strategies along 
with associated roles and responsibilities, triggers, and deadlines. 

In addition, in September 2013, we reported that while NOAA had 
established contingency plans for the loss of geostationary satellites, 
these plans did not address user concerns over potential reductions in 
capability and did not identify alternative solutions and timelines for 
preventing a delay in the Geostationary Operational Environmental 
Satellite-R (GOES-R) launch date. We recommended the agency revise 
its contingency plans to address these weaknesses. In February 2014, 
NOAA released a new satellite contingency plan that improved in many, 
but not all, of the best practices. For example, the updated plan clarified 
requirements for notifying users regarding outages and impacts and 
provided detailed information on responsibilities for each action in the 
plan, 

NOAA has demonstrated leadership commitment In addressing data gaps 
of its polar-orbifing and geostationary weather satellites by making 
decisions about how to mitigate potential gaps and by making progress in 
implementing multiple mitigation activities. However, capacity concerns— 
including computing resources needed for some polar satellite mitigation 
activities and the limited time available for integration and testing prior to 
the scheduled launch of the next geostationary satellite — continue to 
present challenges. In addition, while both programs have updated their 
satellite contingency plans, work remains to implement and oversee 
efforts to ensure that mitigation plans will be viable if and when they are 
needed. 


Sustaining Attention 
on High-Risk 
Programs 


Overall, the government continues to take high-risk problems seriously 
and is making long-needed progress toward correcting them. Congress 
has acted to address several individual high-risk areas through hearings 
and legislation. Our high-risk update and high-risk website, 
http://www.gao.gov/highrisk/ can help inform the oversight agenda for the 
114th Congress and guide efforts of the administration and agencies to 
improve government performance and reduce waste and risks. In support 
of Congress and to further progress to address high-risk issues, we 
continue to review efforts and make recommendations to address high- 
risk areas. Continued perseverance in addressing high-risk areas will 
ultimately yield significant benefits. 
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Thank you, Chairman Chaffetz, Ranking Member Cummings, and 
Members of the Committee. This concludes my testimony. } would be 
pleased to answer any questions. 

For further information on this testimony, please contact J. Christopher 
Mihm at (202) 512-6806 or mihmj@gao.gov. Contact points for the 
individual high-risk areas are listed in the report and on our high-risk web 
site. Contact points for our Congressional Relations and Public Affairs 
offices may be found on the last page of this statement. 


(451143) 
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Chairman Chaffetz. We’ll now recognize the gentleman from 
Georgia, Mr. Hice, for 5 minutes. 

Mr. Hice. Thank you, Chairman. 

Just one quick question for you, and thank you for joining us this 
afternoon. Since the enactment of the Veteran’s Access, Choice and 
Accountability Act, I have a number of veterans in my district who, 
because of their location where they live, they’ve not been able to 
utilize the VA Medical Centers, and so they have opted to use non- 
VA doctors and so forth. And one of the issues they’re facing are 
significant delays from the VA in paying those medical providers. 

Is there anything that you — that the GAO plans to do in the fu- 
ture to evaluate this issue and to report on it in the future? 

Mr. Dodaro. Actually, we’ve already addressed that issue, and 
the issue to report, talking about the problems they were having 
in paying providers in a timely manner. We’re also concerned about 
the fact that the VA doesn’t always have information enough to 
make sure that they’re making the right decisions in terms of 
whether they should be providing the care or going on non- 
healthcare provider, both for access purposes and for making sure 
that it’s a cost-effective approach. 

Debbie Draper’s our expert in this area. I’ll have her talk about 
the recommendations we’ve made, but we’ve already addressed this 
issue and we plan to followup, sir. 

Mr. Hice. OK. 

Ms. Draper. Yes. We actually conducted work about a year or so 
ago, and we made a number of recommendations around the infra- 
structure surrounding the non-VA care. And a lot of the issues 
were not paying claims promptly, and so we do have concerns 
about non-VA care and, you know, we have concerns that it may 
not be the panacea that people envision it could be, because there 
is not really the infrastructure in place, or it wasn’t in place, you 
know, when we took a look at the work. So, you know, you’re talk- 
ing about putting people — the VA system is a very difficult system 
to navigate, so now you’re also asking them to navigate another 
system that’s outside of the VA. So there’s just a lot of issues 
around non-VA care. And the other issue is that wait times for 
non-VA care is not really tracked, so no one really knows how long 
people are waiting to get care in the community. So there’s just a 
lot of issues, and it is something we’ll be looking at. And the Choice 
Act does have several mandates for GAO to look at the non-VA 
care. 

Mr. Hice. Well, thank you. Obviously the concern is if these pay- 
ments are slow in being received, at some point I’m fearful that our 
veterans will receive diminished health care across the board, and 
that is the concern. I thank you. 

And I yield my time. 

Mr. Dodaro. Yes, I’m concerned too. Congressman. We’ll stay on 
top of it. 

Mr. Hice. Thank you, sir. 

Chairman Chaffetz. The gentleman yields back. We’ll now rec- 
ognize the ranking member, Mr. Cummings from Maryland, for 5 
minutes. 

Mr. Cummings. Thank you very much, Mr. Chairman. 
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Mr. Dodaro, one of my major concerns have been drug shortage. 
Whether the Members of Congress know it, but 99 percent of all 
hospitals in this country have drug shortages. And there are peo- 
ple, Mr. Dodaro, as you know, who are, unbeknownst to them, get- 
ting second-, third-rate drugs. And even in my own district, with 
one of the No. 1 hospitals in the world, Johns Hopkins, they have 
told us that they have those problems. 

Can you comment briefly on that, where we are on that and what 
can we do about that? 

Mr. Dodaro. Yes. This is a very important issue. Congressman. 
One of the things that we’ve already suggested to the Congress and 
they’ve acted on, before drug manufacturers didn’t have to notify 
FDA if they were going to have potential shortages, and now they 
have to provide adequate notice ahead of time. So that was one 
step in the right direction. 

Marcia Crosse, our expert in that area, will talk about other 
work we’ve done and recommendations we’ve made to address this 
issue. It’s one of the reasons FDA’s on the high-risk list. 

Ms. Crosse. Yes. Congressman, we agree that it’s a big concern, 
and drug shortages is one of the areas that’s keeping FI)A on the 
high-risk list. As the Comptroller General mentioned. Congress did 
take action to require advance notification to FDA if a manufac- 
turer was going to cease producing a drug. Congress, just over a 
year ago, also enacted the Drug Quality and Security Act that we 
believe can help particularly with this issue of substandard drugs, 
because it’s enacted requirements for tracking of drugs through the 
system that can help reduce the possibility of the gray market 
drugs that I know you had been concerned about, and also counter- 
feit drugs getting into the system, because there’ll be a system of 
tracking. It’s still not implemented. It will take a number of years 
for that to go into effect, but that Act, we think, also has potential 
to address that. 

We are continuing to track drug shortages and we have ongoing 
work looking at it. We know the number of shortages is coming 
down, but there are still some that are persisting for long periods 
of time for multiple years for certain drugs. 

Mr. Cummings. I am glad, because our committee a few minutes 
ago, the greatest part of our plan to look at generic drugs. Again, 
every single Member of Congress has this problem, and they 
don’t — probably many of them don’t even know it, that generic 
drugs are going up sometimes as much as 800 times in a matter 
of a day, which is ridiculous. And it’s about greed. A lot of it is 
about greed. 

But let me go into another thing — issue, the whole issue of cyber. 
You know, I just want to read from your report, Mr. Dodaro, and 
you — ^you all say this, “The increasing sophistication of hackers and 
others with malicious intent and the extent to which both Federal 
agencies and private companies collect sensitive information about 
individuals have increased the risk of personally identifiable infor- 
mation being exposed and compromised.” 

That’s an accurate Statement. Is that right? 

Mr. Dodaro. Yes. 

Mr. Cummings. Your report goes on to say, “The number of re- 
ported security incidents involving PIT at Federal agencies has in- 
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creased significantly in recent years and a number of high profile 
breaches of PIT have occurred at commercial entities. For these rea- 
sons, we added protecting the privacy of PIT to the high-risk area.” 

So your report highlights attacks against both public and private 
sector entities. And one thing these attacks seem to have in com- 
mon is the hackers want to access — want access to personal infor- 
mation of as many Americans as possible. That’s a major problem. 
Is that right? 

Mr. Dodaro. That’s exactly right, and that’s why we’re adding 
it to the list. And, Congressman, there’s projections by informed 
parties that the amount of information that’s collected, stored and 
disseminated is going to double and triple every 2 or 3 years, so 
this problem is on a trajectory to get a lot worse before it gets 
under control. 

Mr. Cummings. So the sources of these hackers could be any- 
where in the world. Is that right? 

Mr. Dodaro. Yes. 

Mr. Cummings. And they could be State-sponsored, they could be 
international criminals, they could be domestic hackers, or any of 
the above. Is that right? 

Mr. Dodaro. Yes. 

Mr. Cummings. And so I see you have your fellow 

Mr. Dodaro. My cyber expert 

Mr. Cummings. OK. 

Mr. Dodaro [continuing]. Right hand here. 

Mr. Cummings. And what can we do about that? If you can iden- 
tify yourself, please, sir. 

Mr. WiLSHUSEN. Sure. My name is Greg Wilshusen. And I think 
there’s a number of actions that both the Congress can do as well 
as Federal agencies who collect this type of information. First, with 
the Federal agencies, agencies need to implement effective informa- 
tion security programs that adequately protect the confidentiality 
and integrity of their information to include not only personally 
identifiable information, but other sensitive information. We have 
found over the years that agencies have not done a very good job 
of this. For example, in Fiscal Year 2014, 17 out of the 24 agencies 
that are covered by the Chief Financial Officers Act reported either 
a material weakness or significant deficiency in their information 
security controls for financial reporting purposes. IG’s at 22 of the 
24 agencies identified cybersecurity or information security as a 
major management challenge for their agency. 

Mr. Cummings. All right. Thank you very much. Chairman. 

Chairman Chaffetz. Thank you. The gentleman yields back. 
We’ll now recognize the gentleman from Texas, Mr. Hurd, for 5 
minutes. 

Mr. Hurd. Thank you, Mr. Chairman. 

And thank you, sir, for being here today. I enjoyed reading your 
report for the outrageousness of some of the things that are listed 
in there. And one of the questions that I have, about 80 percent 
of the administration’s IT spending goes to maintain legacy sys- 
tems. Many of those systems most Americans would think would 
be incredibly out of date. What’s a more appropriate, you know, in- 
vestment-to-maintenance ratio? 



47 


Mr. Dodaro. Well, we’ve said — and I’ll — this is Dave Powner, our 
expert in the IT area. What we’ve said is that this should he under 
operational re-evaluation every year. There are ways to drive down 
technology costs, and a lot of areas the costs are decreasing if 
you’re making the proper investments and reinvestments. We find 
a lot of duplication where the systems are being duplicated because 
of a lack of oversight and a portfolio assessment. The Congress has 
underscored the need to be able to do this in the agencies, but un- 
fortunately, the trends are going in the wrong direction, or there’s 
additional spending in the O&M area, operations and maintenance 
area, rather than coming down as it should be in that area. And 
Dave can talk about more specific recommendations that we’ve 
made. 

Mr. Powner. Yes. Congressman Hurd, to highlight the trends, 
we are spending — $80 billion spent right now. We’re only spending 
about $15 billion on new development. The remainder is going to- 
ward operation and maintenance. That’s why in our high-risk re- 
port, there’s many areas where we have inefficiencies. Data center 
consolidation, there’s about $7 to $10 billion on the table if we con- 
solidate data centers appropriately. There’s also 

Mr. Hurd. On that question, the report highlights shy of 10,000 
data centers. What should be — where should that number be? 

Mr. Powner. Well, I think the plan is to close about 4,000 of 
those 10,000, roughly. That’s the game plan for all the major Fed- 
eral agencies right now. And the game plan is to save at least 
seven and a half billion dollars through 2017. So that’s right 
around the corner. 

You know, in addition to data centers, we have a lot of duplica- 
tion that this committee has focused on over the past couple of 
years. There’s probably another, you know, $5 billion in savings 
looking at duplicative systems too. So you can easily get to over 
$10 billion in savings. Move that inefficient spending out of the 
O&M spend and into the development where we’re modernizing the 
government more appropriately. 

Mr. Hurd. Thank you. And my question, along the same lines, 
CIOs play an important role in oversight and governance of these 
projects. Are Federal agencies, CIO’s effective, and what tools do 
they need to become more effective? 

Mr. Powner. I think with the Federal CIO, it’s a mixed bag. We 
see some CIOs that are quite successful and others that aren’t, and 
that’s why I think the legislation that this committee was instru- 
mental in passing, FITARA, which strengthened the CIO authori- 
ties, is going to be really instrumental going forward so that we 
can manage this $80 billion more appropriately. 

Mr. Dodaro. The CIOs need to be more involved and they need 
to be held accountable for these efforts and it needs to be more uni- 
form across the government, and if this legislation’s successfully 
implemented, we should achieve those goals. 

Mr. Hurd. On the area of accountability, Mr. Dodaro, how long 
have you been with GAO? 

Mr. Dodaro. This June, it’ll be 42 years. 

Mr. Hurd. Have you seen anybody in the Federal Government 
fired for cost or time overruns? 
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Mr. Dodaro. I’m trying to think. I’m sure there have heen people 
have heen in big trouble as a result of it. I could tell you that. I 
know about that. I can’t think of any specific personnel actions off- 
hand, but there have been people who have been under a lot of 
scrutiny and have — and have, you know, suddenly retired in that 
process. So, yes, there have been people that have been moved out. 

Mr. Hurd. Good copy. Thank you. 

I yield back my time. 

Mr. Connolly. Would my colleague yield just for a second? 

Mr. Hurd. Yes. 

Mr. Connolly. I thank my colleague. You brought up two very 
important points on CIOs and on legacy systems and — and data 
center consolidation. The FITARA bill, also known as Issa- 
Connolly, our preferred name, does address all three things and 
mandates status and a consolidation, also requires — there are 250 
people with the title CIO spread out over 24 Federal agencies. 
Imagine that. So our bill says there ought to be one primary CIO 
for every agency who’s accountable and has authority. 

So that’s what Mr. Dodaro’s talking about, about hopefully with 
the implementation of that bill, we’re going to see some real 
progress. And it’s something I hope we will monitor. I know Mr. 
Meadows and I intend to do that in the subcommittee. Thank you. 

Chairman Chaffetz. Thank you. The gentleman yields back. I 
now recognize the gentlewoman from the District of Columbia, Ms. 
Norton, for 5 minutes. 

Ms. Norton. Thank you very much, Mr. Chairman. 

My colleague asked about cost overruns. If people get fired for 
cost overruns, half the Defense Department would be gone, because 
that’s where you have most of the cost overruns in our country. I’m 
very interested in this high-risk list, because I’ve been obediently 
listening to this list for a long time, and I never knew much about 
how you get on it and how you get off it, so I’d like to drill down 
a little bit about it, particularly considering that GAO must look 
at what must be hundreds, thousands of agencies in order to draw 
its list. 

And I must say, whenever there’s good news, it seems to me this 
committee ought to be the first to note it, but I did note that high- 
lighted, I think almost in your first page, it says solid, steady 
progress has been made in the vast majority of high-risk areas. I 
don’t believe I’ve seen that kind of language before in your reports. 

You say that more than one-third of the areas previously des- 
ignated as high-risk have been removed. So I’d like to know, you 
know, how do you get on it and how do you get removed? 

Mr. Dodaro. Sure. First of all, we have published criteria that 
we vetted with the executive branch years ago about how you get 
on and how you come off. 

How you get on is we look at the significance of the risk, both 
in quantitative terms, in other words, there has to be at least a bil- 
lion dollars in risk; there has to be issues, it’s either a public safety 
issue, like oversight of medical products and food safety, we have 
on the list; has to be important to national security, economic secu- 
rity for the country; it has risk of program failures, programs actu- 
ally not achieving their objectives because they’re on the high-risk 
list. And there — so there’s a long list of factors that we consider. 
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And we also look as to whether or not the agencies have corrective 
action plans in place. If they do have a plan and it looks like it’s 
going to be a good plan and they may be successful, we may hold 
off on putting them on the list, and give them an opportunity to 
fix it. 

Now, you come off by five criteria: Top leadership commitment. 
There has to be a commitment by the top leaders in the agencies 
sustained; they have to have the capacity, the people and the — and 
the number of people and the right skills and the right numbers 
and resources to be able to fix the problem; they have to have a 
good plan, a corrective action plan that addresses the root causes 
of the problems; you have to have a monitoring effort to — with in- 
terim milestones and metrics; and you have to actually then dem- 
onstrate that you are fixing the problem. If you meet those five cri- 
teria, you come off the list. If you do that in part of the high-risk 
area, we narrow the high-risk area to those areas that you haven’t, 
like we mentioned this year we did in two areas. So that’s — that’s 
how you do that. Now, the 

Ms. Norton. Now, I noticed the second, I think the second cri- 
teria you mentioned the word “resources.” Wouldn’t it would be fair 
to say that a significant challenge for getting off the list would be 
the scarcity of funding these days 

Mr. Dodaro. Well 

Ms. Norton [continuing]. Since it’s one of your criteria. 

Mr. Dodaro. Yes. Well, by “resources,” we mean the skills nec- 
essary, the right people. 

Ms. Norton. So it doesn’t mean funding at all. Let me ask 

Mr. Dodaro. No. Well, it can mean 

Ms. Norton [continuing]. Is funding a significant challenge for 
agents implementing your recommendations and getting off the 
list? 

Mr. Dodaro. It could be, but it could be that they’re not using 
the funding that they have very well. It’s not necessarily mean 
they need more funding. 

Ms. Norton. Accepted. Could I ask you what Congress can do, 
you know, assuming that Congress is not going to do much about 
resources? I’ll take an area of specific interest to me, real eState. 
That is the area, the Federal Government’s handling of its real eS- 
tate portfolio has been under constant criticism from the GAO. 
Could you tell me how, considering the billions of dollars involved 
in leasing and construction, how real eState portfolio is doing? 

Mr. Dodaro. Yes. First I would say, on the high-risk list, we 
have asterisk areas where the Congress needs to take action in 
order to help address the area. So there’s a substantial number of 
the 32 areas that we’ve already designated for Congress. Postal 
Service reform’s one, cybersecurity’s another, and the need to fi- 
nance the Nation’s transportation infrastructure system’s another 
one. So we’ve designated major areas where Congress needs to be 
part of the solution to the problem. 

In the real property area, what Congress can do, one of the areas 
that we — that’s on the list is the overreliance on leasing. And we’ve 
tried to convince the agencies, particularly GSA, to put forward a 
case to the Congress that says, look, we would be — it would be 
cheaper to own this particular property rather than lease these 
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properties, but they’ve been reluctant to do so. So we think the 
Congress ought to mandate that they do that in that area. There 
are also, you know, underutilized properties, that the Congress 
could give additional authority in pilot areas to try to provide these 
things. There’s a lot of barriers that we’ve identified that the Con- 
gress could help alleviate for the agencies to do this, but they need 
a good strategic plan. They have not yet presented the Congress 
with a good strategic plan on how to address this area. We’ve rec- 
ommended it, they’re working on the plan right now for the first 
time, and so we’re hopeful to see it this year, and hopefully it will 
provide a good roadmap for them and for the Congress. 

Ms. Norton. Thank you. Very useful. 

Chairman Chaffetz. Thank you. I thank the gentlewoman. Now 
recognize the gentleman from Texas, Mr. Mica, for 5 minutes. 

Mr. Mica. Texas. The State 

Chairman Chaffetz. Sorry. How about the State of Florida? 

Mr. Mica. Texas, Texas. 

Chairman Chaffetz. Florida. Florida. 

Mr. Mica. Where it’s warm. 

Mr. 

Unidentified Speaker. Don’t mess with Texas. 

Mr. Mica. Mr. 

It’s a great State, but I’d rather be from Florida right now. Mr. 
Dodaro, have you ever seen the movie “Groundhog Day?” 

Mr. Dodaro. Yes. Over and over. 

Mr. Mica. Yes. Well, I’m sitting here, and I swear a lot of the 
recommendations are the same recommendations you’ve brought us 
before. I segue from Ms. Norton’s and your comments. In fact, I 
just read — the chairman, myself, Mr. Denham, we have heen inter- 
ested in excess property, and you can’t get people to move on deal- 
ing with excess property. I think we’ve found 14,000 at GSA. And 
we did the first hearing at the Old Post Office, and I put an X 
through and I put 13,999. We’ve done about six more in vacant 
properties, some of them moving, hut, you know. I’m only going to 
be here so long. Even this guy’s young. He can’t — we can’t do a 
hearing on every property. 

What concerns me, and you just said it in your report, is 0MB, 
in conjunction with landholding agencies, could improve its capac- 
ity and action by implementing, this is dealing with excess — or un- 
derutilized properties, to develop a strategic plan. They have not 
done that. 0MB has not done that. 

Mr. Dodaro. That’s correct. 

Mr. Mica. One of the things too, and I’ve discussed this, Mr. 
Chairman, briefly with Mr. Denham, in the bill that — there were 
two bills offered, Mr. Chaffetz offered one, I worked with Mr. 
Denham, and he authored another, but we need a requirement that 
they have a plan and then there he some annual action on the plan 
and the recommendation, some triggering mechanism. Wouldn’t 
you agree? 

Mr. Dodaro. Yes. 

Mr. Mica. And none of them will make a decision. The stuff just 
sits there. It sits there, it sits there. So I come back again and 
we’re having a Groundhog Day on excess property. 
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Finally, on the administration, this is on — the administration re- 
leased the results of a freeze on footprint policy, which they indi- 
cated a freeze reduced the government’s office and warehouse 
space. They gave you that report, you analyzed that report, and 
they claim they reduced the Federal warehouse space by 1. — I’m 
sorry — 10.2 million square feet, but then you said they didn’t. 

Mr. Dodaro. That’s correct. 

Mr. Mica. Can you elaborate? 

Mr. Dodaro. Yes, Phil Herr is our leader on that report. 

Mr. Herr. Hi, Mr. Mica. Yes. One of the things we like to do is 
go behind some of those kind of estimates, take them apart, try to 
see where some of the flaws are, and in looking at the freeze and 
footprint data, we saw some things that were miscounted, also 
things that were vacant, but then they were counted separately in 
GSA’s data base. 

One of the things that really underscores and is something that 
we have testified before your subcommittees previously is the real 
problem with the data on the property. 

Mr. Mica. That is right. We found in fact, one, they didn’t know 
what property they had. 

Mr. Herr. Right. 

Mr. Mica. They didn’t know the condition of the property that 
they had. 

Mr. Herr. Correct. 

Mr. Mica. They didn’t know the status of it for being eligible for 
either future utilization or current or keep an inventory. I mean, 
right down the line they did not know. They — in fact, they gave us 
lists that we checked and you checked that showed that — that what 
they were giving us was totally incorrect. Is that not correct? 

Mr. Herr. That is correct. 

Mr. Mica. OK. Well, this is something else we have got to get 
is some requirement for these agencies, and if 0MB won’t do it, we 
can do it statutorily. I know Mr. Chaffetz is committed to get a bill 
through the House and the Senate that will get a handle on this, 
but we have to have triggers. We have to have milestones. We have 
to have some measure of them achieving a goal or performance. Am 
I wrong? 

Mr. Dodaro. I agree, and any major management reform that 
has been successful over time has a statutory underpinning, and 
that will transcend in administrations and Congress 

Mr. Mica. Coming soon. Thank you. 

Chairman Chaffetz. The gentleman now yields back. 

Now recognize the gentleman from Virginia, Mr. Connolly, for 5 
minutes. 

Mr. Connolly. Thank you, Mr. Chairman, and thank you, Mr. 
Dodaro, for being here. This is — maybe it says what a wonk I am, 
but I actually really look forward to this hearing every year, and 
I congratulate you for the intellectual underpinning of identifying 
these risk categories. I think it is an incredible, helpful public pol- 
icy document, and I hope a useful management tool. It also guides 
us, and especially this committee. So much of what you are talking 
about is all about our agenda. So hopefully we will also take it to 
heart and respond accordingly. 
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Mr. Dodaro, you actually endorsed our bill, FITARA, also known 
preferably as Issa-Connolly. How important is it to you that that 
get implemented? 

Mr. Dodaro. It is very important. I mean, that is a critical — that 
is one of the reasons, actually, that we put IT acquisitions and op- 
erations on the list, is in order to elevate attention to make sure 
that FITARA, Issa-Connolly, hill is implemented effectively. 

Mr. Connolly. I am sorry. What was that last part? 

Mr. Dodaro. But if it doesn’t have attention, and I am also con- 
cerned, because, you know, we are coming to the last 2 years of 
this administration, it has got to he sustained in the next adminis- 
tration, having a statutory underpinning is critically important, 
and it gives us and the Congress means to hold people accountable 
over time. So it is absolutely critical to rectifying this problem that 
we have identified. 

Mr. Connolly. And there are real potential savings if we can 
make this work. Is that not correct? 

Mr. Dodaro. Oh, yes. Absolutely. Absolutely. In the billions. 

Mr. Connolly. In the billions, Mr. Chairman. 

So I know we are going to work on a bipartisan basis to actually 
have oversight hearings on implementation to go and exhort and 
encourage, and I think that is really good. 

Mr. Dodaro, with respect to this whole subject, you are familiar 
with the 25-Point Implementation Plan to Reform Federal Tech- 
nology Management that was issued December 9, 2010 by Vivek 
Kundra. 

Mr. Dodaro. Yes. Yes. I am familiar with it, and I am joined by 
Dave Powner, who is our IT expert. 

Mr. Connolly. And I assume that you both — well, let me not as- 
sume. Was that a helpful document in terms of laying out goals 
and objectives? 

Mr. Dodaro. Yes. 

Mr. Connor. Yes, it was extremely helpful. It set the founda- 
tion — 

Mr. Connolly. Sets the foundation. 

Mr. Connor [continuing]. For a lot of the key initiatives going 
forward. 

Mr. Connolly. And, for example, when it talks about we ought 
to approve funding of major IT programs only when it meets three 
basic criteria, right: Have a dedicated program manager and a fully 
staffed integrated program team; use a modular approach with use- 
able functionality delivered every 6 months, I think they mean by 
that break up huge multi-year complex systems integration con- 
tracts so that they are easier to manage; and, third, use specialized 
IT acquisition professionals. Are those — do you think those are 
three helpful criteria when we are looking at issuing a major pro- 
curement? 

Mr. Connor. Absolutely. 

Mr. Connolly. And did we follow that advice from the White 
House itself when the Website for the healthcare rollout was occur- 
ring? 

Mr. Connor. No. We did not. 

Mr. Connolly. We did not. So, hopefully, our bill, but also even 
the guidance that Vivek Kundra issued from the White House 
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going 4 years ago-plus might have spared us some of the grief and 
embarrassment that, in fact, occurred. 

Mr. Dodaro. Yes, they have — we have issued nine factors that 
are critical to successful efforts that have been put in place. There 
is Vivek’s guidance. There is GAO guidance. There is best practice. 
The basic problem that I have seen over the years is there is a lack 
of discipline to follow good practices. 

Mr. Connolly. Yes. 

Mr. Dodaro. We get off the rails and nobody is held accountable 
during that period of time. Modular development, incremental de- 
velopment, CIOs, was one of the basic tenants in the 1996 legisla- 
tion that I helped Congress work on passing. It just hasn’t been im- 
plemented. So I commend this committee for your recent legisla- 
tion. I look forward to working with you to make sure it is success- 
fully implemented, but it will require congressional oversight, and 
I look forward to that. 

Mr. Connolly. And I will point out, as the chairman knows and 
the ranking member knows, when we put together this bill, it was 
a bipartisan bill, and we — a lot of what we did was codify rec- 
ommendations that came out of the White House itself. It was not 
a hostile bill, and so hopefully it will be seen that way, as a useful 
management tool, and we look forward to working with you as we 
follow and monitor, and, as I said, exhort the implementation, be- 
cause there are enormous savings to be had and some very signifi- 
cant efficiencies. So 

Mr. Dodaro. Yes, and better services to the public. 

Mr. Connolly. Yep. Thank you, Mr. Chairman. 

Chairman Chaffetz. Gentleman yields back. 

Now recognize the gentleman from Tennessee, Mr. Duncan, for 
5 minutes. 

Mr. Duncan. Well, thank you, Mr. Chairman, and I don’t — I will 
take just a moment. I just want to say, Mr. Dodaro, I think you 
do a very good job, and I appreciate the work the GAO does. You 
have been very helpful to me on this committee. I have been here 
26 years. When I tell these newer members this, they look at me 
like I am from outer space. May main committee has always been 
the Transportation and Infrastructure Committee, and I have 
heard Dr. Dillingham testify more probably than any other wit- 
ness, and he seems like a good man. 

Mr. Dodaro. He is. 

Mr. Duncan. But I just want to say that I think the GAO does 
a great job, and I appreciate what you all do, and that is all I want- 
ed. Thank you, Mr. Chairman. 

Mr. Dodaro. Thank you very much, Mr. Duncan. 

Chairman Chaffetz. Gentleman yields back. 

We will now recognize the gentlewoman 

Mr. Connolly. Mr. Chairman, I know that there are other wit- 
nesses who want to know Mr. Dodaro’s magic is that he got that 
kind of 

Chairman Chafeetz. We will now recognize the gentlewoman 
from the Virgin Islands, Ms. Plaskett, for 5 minutes. 

Ms. Plaskett. Yes. Thank you, Mr. Chairman. Good afternoon, 
sir. 

Mr. Dodaro. Good afternoon. 
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Ms. Plaskett. I really wanted to thank you for all of the work 
that your agency does and to talk to you about one of the primary 
things that you all do is uncovering waste and fraud and abuse and 
identification of the risk of integrity of the Federal programs. We 
know, however, that there is also best practices that your agency 
tries to identify, not only for the private — for the public sector, but 
for the private as well, and we understand now that the cyber at- 
tacks are not just on the Federal agencies, but also on private. We 
know — we have heard about Home Depot and the compromise of 
about 56 million companies and the credit card and debit card in- 
formation, as well as Anthem, the Nation’s second largest health 
insurance company with more than 80 million records that may 
have been compromised. I see that your — one of your colleagues are 
coming over to assist you. 

Mr. Dodaro. This is our cyber expert, Greg Wilshusen. 

Ms. Plaskett. Great. 

Mr. Dodaro. We sense a cyber question. 

Ms. Plaskett. You sense very well. One of the things I wanted 
to talk with you about is this notion of segregating duties. If you 
could briefly explain for us what that concept is and how that 
works. 

Mr. Dodaro. Yes. Now, that has been one of the major problems 
that we have identified over the years. Greg can explain the impor- 
tance of it. 

Mr. Wilshusen. It is vitally important to assure that systems 
and information are adequately protected from unauthorized modi- 
fication alteration. And it basically relates that the activities of one 
individual or group are countered by the activities or overseen, if 
you will, by the activities of another group. So one group does not 
have full control of a transaction or of a process in which it can 
then perform unauthorized activities without detection. Within the 
cyber realm, that often relates to having, for example, software de- 
velopers being able to operate in the production environment where 
real live actual data is being processed because they could poten- 
tially make undetected changes to the software process and that 
data, and you don’t want that to happen. So software developers, 
in this case, should be confined to a development and PRO-ART en- 
vironment. 

Ms. Plaskett. OK. So my understanding, and, you know, I am 
not — my children will tell you I have no — I am a Luddite. I have 
to technological knowledge, but kind of like a submarine where 
when there is a leak in one area you can close off that section and 
then another area where the leak occurs doesn’t infect the other 
areas with the segregation of duties. Is that occurring now in the 
Federal agencies with the IT? 

Mr. Wilshusen. Yes. In several agencies there are instances 
where they have weaknesses, and I think it is about 14 agencies 
that have weaknesses and segregation of duty controls, and the ex- 
ample you highlighted actually also speaks to defense in depth, and 
that is another security defense principle that agencies should put 
layer upon layer of security controls so in the event that one layer 
may be circumvented or penetrated, that other controls help to pro- 
tect the data and systems at hand. 
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Ms. Plaskett. So now one of the reasons that I mentioned Home 
Depot and Anthem, we know that this has occurred in other pri- 
vate sector areas, is what is the relationship that you all have with 
trying to assist those private sector individuals in best practices, 
because at the end of the day, all of these systems connect with one 
another. 

Mr. WiLSHUSEN. Yes. Actually, it is the Department of Homeland 
Security that has an overriding role within the Federal Govern- 
ment for helping in assisting with critical infrastructure industries 
in protecting their information and their systems. In addition, for 
certain retail companies like this, it may also be the Federal Trade 
Commission that would also provide assistance and guidance to 
those entities. 

Mr. Dodaro. We have been encouraging and exhorting for years 
more dialog and information sharing between the public sector and 
the private sector. Both have been reticent for different reasons to 
share information, but that is really the only way that this problem 
is eventually going to be solved. Congress has made some overtures 
in this area and legislation. We believe more legislation could be 
helpful in this regard. 

Ms. Plaskett. Well, I am hopeful that this body will continue to 
assist you in making sure that that happens, and I yield the bal- 
ance of my time. 

Chairman Chaffetz. Thank the gentlewoman. 

We will now recognize the gentleman from Massachusetts, Mr. 
Lynch, for 5 minutes. 

Mr. Lynch. Thank you, Mr. Chairman, and ranking member, 
and, Mr. Dodaro, good to see you again, and all your cohorts. I 
agree with Mr. Connolly’s remarks that this may not be the most 
sexy hearing of the year, but 

Chairman Chaffetz. Objection. 

Mr. Lynch. Well, I think it may reflect best the core mission of 
this committee, however. I do notice in your list of areas of concern, 
you have got a list of — that 2015 high-risk list, that the VA Health 
is on that list for the first time, and I know it is one of the two 
new areas, and this designation comes in light of the longstanding 
and systemic weaknesses in accessibility and quality of care. We 
saw the problems that we had down at the Phoenix VA, a terrible 
situation there. And we also have, quite frankly, a huge increase 
in the number of veterans that are now, for the first time in their 
lives, relying on the VA for their healthcare. We went from 6.8 mil- 
lion veterans in 2002 to 9.4 million enrollees in 2015. So it has put 
a huge amount of pressure on the system, including 1.4 veterans 
form Operation Iraqi Freedom and Enduring Freedom in Afghani- 
stan, and mindful that most of those folks did multiple tours. 

And I was in Kandahar Province not long ago, and I asked how 
many folks were on their first tour, their second tour. I got all the 
way up to seven tours of duty before I ran out of Marines. Most 
of them had been there three or four tours of duty. So that re- 
peated cycle of deployments does a lot of damage, I think, to the, 
you know, the psychiatry of serving among our young men and 
women, and I think that we are going to see reverberations in the 
healthcare system as a result of those multiple deployments, but I 
am looking forward. 
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That is — I am actually the ranking Democrat on the National Se- 
curity Subcommittee that is going to address those, and I look for- 
ward to your good work continuing in that area, especially with 
some of the new implementations that we have had allowing vet- 
erans to be treated at non-VA facilities if we do have a backup in 
appointment time, and that has been a constant problem for us not 
just in the Northeast but all across America, and I know Florida 
is all backed up because of the number of retirees down there. They 
have had a very long backlog there. Some of the areas in Texas as 
well. Virginia, my friend, Mr. Connolly, a huge number of veterans 
in his district as well, and also we have got another provision that 
allows them to go to non-VA facilities where their travel to a VA 
facility is more than 40 miles. So it all builds up to a greater reli- 
ance on our ability to conduct oversight on the VA healthcare sys- 
tem. I look forward to working with you. You have got a great staff. 
You have got a good cohort of people behind you that have worked 
tirelessly over the years. I am looking forward — we have got no 
shortage of issues to work on, and I just appreciate the work that 
you do every single day. Thank you. 

Now I yield back. 

Mr. Connolly. I would ask my friend to yield. 

Mr. Lynch. Oh, yes. Sure. 

Mr. Connolly. For a question. Mr. Lynch, how many times have 
you been to Afghanistan or Iraq? 

Mr. Lynch. I would say Iraq about 14 times, and I would say Af- 
ghanistan about 12 times, oftentimes with folks from — that Mr. 
Dodaro works with, a special inspector of — Special Inspector Gen- 
erals of Iraq Construction or Afghanistan Reconstruction as well. 

Mr. Connolly. Well, I just want to say, for me, you have been 
a model of oversight commitment to the work in both countries at 
personal risk and peril to yourself, and I honor you for that. Thank 
you. 

Mr. Lynch. Well, thank you. 

Mr. Dodaro. I would just say in terms of the picture that you 
paint, not only have we had more veterans coming back with mul- 
tiple tours, but they are going to be living longer thanks to modern 
medicine, but this problem will occur over decades, and we need to 
get a handle on it right now. There will be more veterans even 
coming back. So this is really a very significant long-term issue, 
and that is one of the reasons that we put it on the high-risk list. 

Mr. Lynch. Thank you. 

Chairman Chaffetz. Thank you. The gentleman yields back. I 
now recognize the gentlewoman from New York, Ms. Maloney, for 
5 minutes. 

Mrs. Maloney. I want to thank you for your work, and I apolo- 
gize to my colleagues. I am late to the committee because I was at 
a meeting on a cyber security, which is really one of the biggest 
challenges we face as a Nation, and I believe it is an area that we 
will in a bipartisan way work together to address. So I want to 
mention the assessments that you have found for dealing well 
cyber attacks. And your report found that many agencies had “In- 
consistently implemented policies and procedures for responding to 
a data breach involving PIT.” 
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Can you explain for the committee those areas in which GAO 
found that agencies were inconsistent in their implementation of 
policies for responding to data breaches, and what do we do about 
it? 

Mr. Dodaro. Yes. Greg Wilshusen will address that. He is our 
expert in the area. 

Ms. Maloney. OK. Great. 

Mr. Wilshusen. Yes. We conducted a review at several Federal 
agencies over their procedures and policies for responding to secu- 
rity incidents involving personally identifiable information, and one 
of the things we identified is that agencies did not consistently 
identify the risk to the affected individuals and the harm that 
could occur or the impact that it could occur to those individuals. 

In addition, they were inconsistent at what point do they provide 
additional services to those individuals. For example, whether or 
not to provide credit monitoring services or other types of services 
in order to help those that have been — whose information has been 
compromised. 

Mrs. Maloney. OK. And to the point, what can Congress do to 
assist you, GAO, in advocating that Federal agencies are being con- 
sistent in carrying out policies that respond to these breaches? 

Mr. Dodaro. We believe that the Privacy Act which was origi- 
nally passed in 1974 needs to be updated, and Congress should 
take that upon their responsibilities. The agencies are collecting 
more information than was contemplated in the Privacy Act be- 
cause the Privacy Act deals with records of information but not 
through social media and other means. More information is being 
collected that wasn’t contemplated when the Act was passed. The 
definitions in the Act are very broad, which leads to inconsistent 
applications that can be done. There is not enough notice that is 
made to the public. Typically in those days, it was through the Fed- 
eral Register, but there are more available tools now to notify the 
public and make things available. So the Congress needs to update 
the Privacy Act, and we would be happy to work with this com- 
mittee or other committees to do so. 

Mrs. Maloney. OK. And, finally, you State, and I quote GAO’s 
report. “Agencies may not be consistently taking action to limit the 
risk to individuals from Pll-related data breaches.” So in GAO’s as- 
sessment, what are specific actions agencies can take right now to 
improve their ability to respond to data breaches on top of rewrit- 
ing the Privacy Act? 

Mr. Wilshusen. Sure. Yes, one of the actions that they can take 
is making sure that they have appropriate policies and procedures 
in place before incidents occur so they know how to act once an in- 
cident will occur. And, indeed, our work has shown that the num- 
ber of incidents involving PIT at Federal agencies is climbing, and 
every agency is affected by that, and that could include having a 
dedicated team available that has the roles and responsibilities 
previously identified and trained in those roles and responsibilities 
in order to act appropriately and timely when incidents occur. 

Mrs. Maloney. And, finally, how can Congress be most useful in 
ensuring that this is fulfilled, that agencies consistently take all 
the necessary actions needed? 
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Mr. WiLSHUSEN. Well, one is, as the comptroller general men- 
tioned, is to update the Federal laws protecting personal — the pri- 
vacy of personally identifiable information. Another is holding over- 
sight hearings and holding agencies to account for their incidents 
that occur and assuring that they appropriately implement proper 
protections of the personally identifiable information that may be 
compromised. 

Mrs. Maloney. Thank you so very much. 

Chairman Chaefetz. Thank you. If no other member has a ques- 
tion for this first panel, we would like to again thank the GAO, 
specifically Mr. Dodaro, and the great work that so many of you 
and your staff do. I would ask that the clerk change the table, and 
I would actually like to mention something as we do in this in the 
essence of time. So again, Mr. Dodaro, thank you. You are excused, 
and go ahead and make the change. I want to talk about the art- 
work that you see in here, and I would like to make a bit of a 
Statement, and, again, there will be a little commotion here as we 
change out the names, and please, if you are on the second panel, 
please come take a seat. 

When I became the chairman, we made some alterations to the 
artwork here, and part of what I was trying to do was I felt it 
would be best to highlight the people that we serve rather than the 
past committee chairmen. I feel strongly that we should be inspired 
by those who — by the American people, and that is who we serve. 
They have done great things over generations of time, and those 
are the types of people that we should be inspired by. 

So I would like to introduce these pieces of art as, again, we get 
this next panel ready, and I will tell you that they are all real pho- 
tography and real photos. I would like to start here with this one. 
It is of the Ben Franklin Bridge and the Philadelphia skyline. It 
was taken by a photographer by the name of Charlie Lansche. It 
is the Ben Franklin Bridge. It spans the Delaware River connecting 
Philadelphia with Camden, New Jersey. 

Contrasting the urban setting, we have this new photo that was 
taken, actually, in my congressional district in Utah. It does look 
like a painting, but it is actual photograph that was taken in Janu- 
ary. It was taken along the Provo River with the Mount 
Timpanogos there in the distance, and we live in a very beautiful 
setting, and I think the contrast between the urban setting and a 
more rural setting is part of what I wanted to highlight. 

Going here on this side, this is a photo that was taken — it was 
first published in March 1966. Warren Leffler was a photographer 
for U.S. News and World Report, and the image is of postal work- 
ers loading mail bags into trucks for delivery, and a good number 
of people for decades, generations, have been doing good work in 
the postal service, and one of our couriers of responsibility. 

This next photo back over here is of Utah copper miners. We 
have had people who have been in the mining industry across this 
Nation, whether it is coal or copper or whatnot. This was first pub- 
lished back in 1942. They are using a rock-drill machine at the 
Bingham Mine in the Bingham Canyon in Utah. 

This next photo was taken in Afghanistan. The American flag 
capturing the morning’s first rays of sunlight as it is hoisted from 
one of the peaks of the Kowtal-e Paymor Mountain on the outskirts 
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of Kabul, Afghanistan, in honor of Veterans Day. It was shot on 
November 11, 2010. Not a professional photographer, but that is 
one of the most beautiful patriotic shots I have ever seen, and real- 
ly appreciate the service that Paul Bingham offered this country 
and the photo that he took that day honoring Veterans Day above 
the hills there in the mountains outside Kabul. We have had thou- 
sands and thousands of Americans serve overseas and in Afghani- 
stan, and we honor them and should be thinking of them regularly. 

This next photo at the back of the room is actually civil rights 
protesters on one of three marches from Selma to Montgomery, 
Alabama. This photo was first published in 1965, they tell me, and 
is a good reminder that people have gone through a lot of hardship, 
but also made a lot of progress. And I love the patriotic nature of 
the carrying of the flags in that photo and appreciate the Library 
of Congress for providing that to us as well. 

The next one is of the Golden Spike. The Golden Spike actually 
happened in Utah. It was taken on May 10, 1869. By joining the 
Central Pacific and Union Pacific lines at Promontory Point in 
Utah on May 10, 1860. The Golden Spike was the ceremonial last 
spike driven in by Lelant Stanford to join these rails to form the 
first Transcontinental Railroad across the United States bridging 
the east and the west together. 

The next photo is really the only portrait that I would consider 
here, but interestingly enough, this was first published in 2006. It 
was from the Library of Congress. The Lincoln Memorial is obvi- 
ously one of the best sites we have in this country and certainly 
in the United States, but when he was Congressman Lincoln, he 
served on the Post Office and Post Roads Committee, and the Ex- 
penditures and the Department of War Committee, two committees 
that preceded the modern day Oversight and Government Reform 
Committee. So interesting to me that Abraham Lincoln, when he 
served in the House of Representatives, served on what is now 
known as the Oversight and Government Reform Committee, an 
inspiration to a lot of people. 

Moving over here, we have got two more. This photo was taken — 
it comes from the Library of Congress. We are not sure who the 
photographer was. It was published sometime between 1914 and 
1918. It is of women making and crimping fiber powder containers 
for 3-inch Stokes guns during World War 1. It was taken at the 
W.C. Ritchie & Company facility in Chicago, Illinois. And, again, 
a great deal of sacrifice that was going on in this country, and I 
actually like — I love the patriotic nature that one as well. 

And, finally, I want you to look closely at this photo if you have 
a chance. This is a steel worker on the framework of the Empire 
State Building high above the city with the Chrysler Building 
prominently displayed in the back. 

Mr. Lynch. Ironworker. 

Chairman Chaffetz. Ironworker. Ironworker. My apologies. The 
photographer was Lewis Hine, and it was first published in 1930, 
and comes to us from the National Archives. Not exactly OSHA 
compliant back then. That gentleman is sitting on the precipice of 
death, working hard to build this country without a safety harness, 
without the types of things that our workers have now, but a good 
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deal of people have made these kind of dedications and sacrifices, 
and I am glad that they captured a photo of it. 

These are the types of people I think should he inspired in this 
committee rather than just the committee chairmen of past, and so 
we made those changes. I hope the committee appreciates that, and 
I am honored to have these photos in here, and I thank the mem- 
bers for my indulgence. 

We would now like to recognize our second panel of witnesses. 

Oh, pardon me. I would like to yield to our ranking member, Mr. 
Cummings, for 5 minutes. 

Mr. Cummings. Mr. Chairman, when you told me that you were 
going to select some photographs, I was — I didn’t know what you 
were going to do, but I must tell you and all of those who had any- 
thing to do with selecting these photographs, that they are abso- 
lutely beautiful. 

You know, I used to say that my father who only had a second 
grade education, but who educated all seven of his kids, I used to 
say that I was inspired by his aspirations, and when we look at 
these pictures, the ones of hard-working Americans in the pursuit 
of happiness and building our country, I believe that their stories, 
I mean, just looking at them, should inspire all of us to be the very 
best that we can and to lift up their lives and people — the people 
like them, their lives, and then, you know, you look at the other 
ones that show our environment. I think it should be a reminder 
that we do have a sacred duty to pass on to our children an envi- 
ronment which is just as good as or better than the one that we 
inherited. 

You know, it is said that we do not inherit our environment from 
our ancestors, but we borrow it from our children, and I would say 
the same thing about our democracy, and so — and last but not 
least, Mr. Chairman, you, you know, you really did a hell of a job 
when you put the Selma one right there because it just reminds me 
every time I look at it, 4 years before that in Baltimore, it re- 
minded me of us marching, little kids, we were marching trying to 
integrate a pool called Riverside Pool, and it was all-white pool. We 
were beaten, but yet still we marched in the pursuit of happiness, 
and so I am — I still like to say that I am hoping that this will be — 
these photos will be an aspiration — will be an inspiration because 
of the aspirations of these folks who made America what it is. 

Thank you very much. 

Chairman Chaffetz. Thank you. I appreciate those comments. 

And now back to the business before us. I thank the five gen- 
tleman who have joined us, and I would like to recognize this panel 
of witnesses. I am pleased to recognize the Honorable John 
Koskinen, who is the Commissioner of the Internal Revenue Serv- 
ice; the Honorable Alan F. Estevez, Principal Deputy Under Sec- 
retary of Defense for Acquisition, Technology and Logistics at the 
United States Department of Defense; Mr. John MacWilliams, Sen- 
ior Advisor at the United States Department of Energy; and then 
Shantanu Agrawal. Did I pronounce that properly? I know you 
have testified previously. 

Mr. Agrawal. You nailed it. 

Chairman Chaffetz. Yes. He is the Deputy Administrator and 
Director of the Center of Program Integrity at the Centers for 
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Medicare and Medicaid Services; and Mr. Robert M. Lightfoot Jr., 
Associate Administrator at the National Aeronautics and Space Ad- 
ministration. 

We thank you for your patience. It has been a while to get to this 
panel, but we do appreciate you here. 

Pursuant to committee rules, all witness be sworn before they 
testify. So if you could rise please and raise your right hand. 

Do you solemnly swear or affirm that the testimony you are 
about to give will be the truth, the whole truth, and nothing but 
the truth? 

Thank you. Let the record reflect that all witnesses answered in 
the affirmative. You may he seated. 

Mr. Koskinen, we will start with you. Your full Statement will 
be introduced into the record, but we would ask that you please 
limit your testimony to 5 minutes, and we will go from there, Mr. 
Koskinen. 


STATEMENT OF HON. JOHN KOSKINEN 

Mr. Koskinen. Thank you. Thank you. Chairman Chaffetz, 
Ranking Member Cummings, and members of the committee. 
Thank you for the opportunity to discuss the Government Account- 
ability Office’s high-risk list as it pertains to IRS operations. I am 
delighted to note that one of our programs. Business Systems Mod- 
ernization, was removed from the list in 2013 after being on the 
list since 1995. Its removal came about because of the advances the 
IRS has made over many years in addressing weaknesses in infor- 
mation technology and financial management capabilities. Turning 
now to tax enforcement, the GAO has identified this as a high-risk 
area because of the size of the tax gap and the difficulty over time 
in narrowing that gap. The most recent IRS study of the tax gap 
released in 2012 found that the tax gap was $385 billion for tax 
year 2006. The IRS is preparing a new study of the tax gap that 
covers tax year 2010, and will be based on audits done between 
2008 and 2010. We expect this report to be released in the first 
quarter of 2016. 

One of the key findings from our ongoing research on the tax gap 
has been that the compliance rate is very high for income that is 
subject to information reporting. Income subject to third party re- 
porting is underreported only about 8 percent of the time. That 
number jumps to 56 percent for income that is not subject to any 
third party reporting or withholding. 

Another thing we’ve learned from our research is that the biggest 
portion of the tax gap involves the underreporting of business in- 
come by individual taxpayers which totaled $122 billion in 2006. 
The evidence is clear that the lack of reliable and comprehensive 
reporting and withholding on this type of income is the main rea- 
son for such a high level of underreporting. A good example of our 
recent efforts to improve compliance in this area involves the legis- 
lative requirement for electronic payment processors, credit card 
companies, to send us information from business credit card re- 
ceipts on a new form 1099-K. The first 1099-Ks were filed in 2012 
for transactions in 2011, and I am pleased to report we are begin- 
ning to see positive impacts on compliance from this new program 
provided by the Congress. 
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Programs such as 1099-K reporting are useful not only because 
they help the IRS to collect the correct amount of tax, but also be- 
cause they encourage voluntary compliance, and the importance of 
voluntary compliance cannot be overstated. A 1-percent increase in 
the level of voluntary compliance brings in about $30 billion annu- 
ally in tax receipts. 

Even with these and other efforts, I would note that it is not pos- 
sible to eliminate the tax gap completely. Getting to 100 percent 
tax compliance would require a huge increase in audits and signifi- 
cantly greater third party reporting and withholding than we have 
now. Realistically, that wouldn’t work because the burden on tax- 
payers and the strain on IRS resources would be far too great. Our 
budget situation represents a very serious challenge to our ability 
to keep making progress on this front. In order to absorb required 
reductions this year, the IRS has taken a number of difficult steps, 
including the loss through attrition of about 1,800 key enforcement 
personnel. That translates into fewer audits and collection cases, 
and we estimate the government will lose at least $2 billion in rev- 
enue that otherwise would have been collected. Additionally, the 
reductions in our funding have forced us to make cuts in taxpayer 
service. This is also troublesome because if we can’t provide the 
services taxpayers need to fulfill their tax obligations, voluntary 
compliance will suffer. 

This concludes my Statements, and I would be happy to take 
your questions. 

Chairman Chaffetz. Thank you. 

[Prepared Statement of Mr. Koskinen follows:] 
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Chairman Chaffetz, Ranking Member Cummings and Members of the 
Committee, thank you for the opportunity to appear before you today to discuss 
the Government Accountability Office’s (GAO) High-Risk List as it pertains to IRS 
operations. 

As we understand it, the GAO's High-Risk List currently contains one item that 
relates to the IRS, which is enforcement of tax laws. Before discussing tax 
enforcement, I would note that another IRS program, the agency’s Business 
Systems Modernization program, was removed from the list in 2013, after having 
been on the list since 1995. 

In its 2013 report, the GAO said that the Business Systems Modernization 
program was no longer a high-risk program because of the advances made by 
the IRS over many years in addressing weaknesses in information technology 
(IT) and financial management capabilities. In fact, in reports issued in 2007, 
2009, and 201 1 , the GAO noted the progress that the IRS was making in this 
area, even though the program continued to be on the High-Risk List during 
those years. 

As the GAO has often pointed out, all of the programs on the High-Risk List 
involve complicated, difficult issues that do not lend themselves to quick fixes, 
but require the use of multiple strategies over long periods of time. This is true 
not only for business systems modernization, but applies to tax taw enforcement 
as well. 

We take very seriously the issues raised by the GAO in regard to tax 
enforcement. The IRS has worked over time, and continues to make every effort, 
to improve compliance with the tax laws, just as it has done and continues to do 
with business systems modernization. Our ability to keep making progress in 
both areas is limited, however, by the substantial reductions in funding for our 
agency over the last several years, which I will discuss in more detail later in this 
testimony. 

The GAO has identified enforcement of the tax laws as a high-risk area because 
of the size of the tax gap and the difficulty over time in narrowing that gap. The 
tax gap is defined as the difference between the amount of tax owed by 
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taxpayers for a given year and the amount that is paid voluntarily and timely. The 
tax gap represents, in dollar terms, the annual amount of noncompliance with our 
tax laws. 

The most recent IRS study of the tax gap was released in 2012 and it covered 
tax year 2006. The study showed that the nation’s voluntary tax compliance rate 
was 83.1 percent in 2006, essentially unchanged from the prior review covering 
tax year 2001. The IRS is in the process of preparing a new study on the tax gap, 
covering the tax year 2010. We expect this report to be released in early 2016. 

The tax gap can be viewed in two different ways. There is the gross tax gap, 
which is simply the amount of tax liability faced by taxpayers that is not paid on 
time. For 2006 it is estimated to be $450 billion. The net tax gap of $385 billion 
represents the amount of tax liability that is not only not paid on time but also is 
not collected subsequently, either voluntarily or as the result of enforcement 
activities. Thus, the net tax gap represents the amount of tax liability that is never 
paid. 

When looked at by mode of compliance, the tax gap can be divided into three 
components: Nonfiling, or not filing required returns on time; underreporting, or 
not reporting one’s full tax liability when the return is filed on time; and 
underpayment, or not paying by the due date the full amount of tax reported on a 
timely filed return. Underreporting constituted 84 percent of the tax gap for 2006, 
while underpayment constituted 10 percent, and nonfiling 6 percent. 

The underpayment gap is the easiest component to measure, because it is 
calculated directly from IRS administrative records for the individual income tax, 
the corporate income tax, employment taxes, estate tax, and excise taxes. 
Taxpayers who have filed returns indicating taxes owed but who have not paid 
the full amounts on time are identified upon filing. The difference between taxes 
owed as reported on returns and the amounts paid on time is the underpayment 
gap. 

The other two components of the tax gap - nonfiling and underreporting - 
present vastly greater estimation challenges because they measure activity that 
is either not revealed to the IRS at all (such as failure to file a return) or is 
reported in an understated or otherwise mischaracterized fashion. 

The predominant method used to calculate the underreporting gap involves 
auditing a random sample of taxpayers. These audits are time consuming, but 
they constitute the ideal method for estimating the underreporting gap for the 
individual income tax. These audits are done under a program called the National 
Research Program (NRP) that has been in place since 2000. The audits are 
more in depth than the usual audits, in that they examine a uniform set of issues 
that are part of the study, instead of focusing on problems with a given tax return. 
The information gleaned from these audits helps examiners more effectively 
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select the types of cases to audit, and offers other detailed insights about 
noncompliant behavior. Those insights are used throughout the IRS to better 
target service and enforcement work. 

One of the key findings from our ongoing research on the tax gap has been that 
tax compliance is far higher when reported amounts are subject to information 
reporting and, more so, when subject to withholding as well. For 2006, the net 
misreporting percentage (NMP) - taking the net amount that was misreported 
(which includes both under- and overreporting items) and expressing it as a ratio 
of the absolute value of the correct amount that should have been reported - was 
1 percent for amounts subject to substantial information reporting and 
withholding, and 8 percent for amounts subject to substantial information 
reporting without withholding. But the NMP jumped to 56 percent for amounts 
subject to small amounts of or no information reporting or withholding. 

In terms of what makes up the tax gap, the underreporting of business income by 
individual taxpayers - income of sole proprietors, farmers and those earning 
rental, royalty, partnership, and S Corporation income - is the largest contributor, 
accounting for $122 billion of the total $450 billion in 2006. We believe that the 
lack of reliable and comprehensive reporting and withholding for business 
income received by individuals is the main reason for these findings. 

These statistics provide further confirmation that “visibility” of income sources 
and financial transactions is the main factor in high compliance rates, and 
information reporting is one of the few means of sizably increasing the 
compliance rate. Business income reported on 1040s is a much lower-visibility 
income source because it is not subject to the same information reporting and 
withholding requirements that exist for salary and wage income. 

It is important to understand that while the tax gap is a helpful guide to the scale 
of fax compliance in the economy, it overstates the amount of tax debt owed that 
is feasible to recover through IRS enforcement alone. 

Major attempts to narrow the tax gap must take into account taxpayer burden 
and taxpayer rights. While it might be theoretically possible to achieve 100 
percent tax compliance, getting to that point would require an extremely high 
volume of examinations and substantial income reporting and withholding 
requirements, all of which would certainly be considered unduly burdensome on 
individuals and businesses, and would also put a major strain on IRS resources, 
as well as on the taxpayer. Put another way, it would not be advisable to audit 
our way out of the tax gap. 

It is also important to point out that failures to comply with tax law often involve 
unintentional mistakes that are the result of not fully understanding what has 
come to be an extremely complex tax code. For that reason, efforts to increase 
tax compliance must also include programs to educate taxpayers in their tax 
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obligations, along with efforts to improve taxpayer service, to make it easier for 
individuals and businesses to fulfill filing requirements. 

Despite the many challenges, the IRS has been and continues to be committed 
to finding ways of improving tax compliance, particularly voluntary compliance, 
which is the cornerstone of our tax system. From a revenue standpoint, the 
importance of voluntary compliance cannot be overstated: Each additional 
percentage point of voluntary compliance established brings in about $30 billion 
in tax receipts. Therefore, any loss of public confidence in the proficiency and 
fairness of the IRS, which reduces voluntary compliance, would come at a high 
cost, and the effects of a reduction in voluntary compliance would take a long 
time to reverse. 

Achieving greater voluntary compliance in order to narrow the tax gap involves a 
comprehensive, integrated multi-year strategy. Along with increased enforcement 
activities which enhance confidence and fairness in the tax system, components 
of this strategy also include: expanding compliance research; improving 
information technology; reforming and simplifying the tax law; coordinating with 
states, foreign governments, and other partners and stakeholders to share 
compliance strategies; and, as noted above, enhancing taxpayer service. 

The agency's program for implementing legislation on merchant card reporting is 
a good example of our recent efforts to narrow the $1 22-billion portion of the tax 
gap that represents underreporting of business income by individuals. This 
program involves requiring electronic payment processors to send us information 
on Form 1099-K. 

Congress enacted the reporting requirement because lawmakers understood that 
cash and credit card transactions were the source of much of the income 
underreporting by small businesses. Bad actors who wanted to gain an unfair 
advantage over those who follow the law could do so simply by not reporting all 
of their transactions. Therefore, in addition to helping improve tax compliance, 
the Form 1099-K reporting regime also helps level the playing field for small 
businesses. 

The challenge for the IRS is determining how to properly use the data gleaned 
from the Form 1 099-K, because reported income is generally a mix of credit card 
and cash receipts. But the Form 1099-K does allow us to compare similar 
businesses, spot anomalies, and follow up with businesses to determine why 
those anomalies exist. In fact, we are already beginning to notice an impact from 
this new reporting regime. 

The IRS has worked to utilize the information received from the Form 1099-K 
while minimizing the burden on small businesses by seeking input from the 
business community on this program and by giving taxpayers extra opportunities 
to respond, fix errors, or explain their situation. In fact, most taxpayers contacted 
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by the agency have responded to our notices, and have taken the opportunity to 
explain unusual circumstances or correct errors, often without an audit. It is 
important to note that about 60 percent of taxpayers we contacted about potential 
underreporting of 201 1 income increased the amount of income reported in 2012. 

Another good example of our recent work to increase tax compliance involves 
the international tax area in general, and offshore tax avoidance in particular. The 
IRS has made great strides over the last several years both in finding tax 
evaders hiding assets overseas and bringing them to justice and in encouraging 
people to voluntarily disclose their foreign accounts and pay the taxes they owe. 

The agency has conducted thousands of offshore-related audits that have 
produced tens of millions of dollars, and, where appropriate, has pursued 
criminal charges leading to billions of dollars in criminal fees and restitution. 
Taxpayers have also been given the opportunity to come forward and get right 
with the government. Since its establishment in 2009, the Offshore Voluntary 
Disclosure Program (OVDP) has resulted in more than 50,000 disclosures of 
underpaid or unpaid taxes and the collection of more than $7 billion in back 
taxes, interest and penalties. 

In 2010, Congress gave the IRS an important new tool to help us improve 
offshore tax compliance when it enacted the Foreign Account Tax Compliance 
Act (FATCA). This law requires foreign financial institutions (FFIs) to report 
information to the IRS about financial accounts held by U.S. taxpayers or by 
foreign entities in which U.S. taxpayers hold a substantial ownership interest. 
More than 150,000 FFIs have registered under FATCA, and in March of this year 
they will begin supplying the IRS with information about overseas accounts of 
U.S. taxpayers. 

Programs such as Form 1099-K reporting and FATCA are important not only 
because they help the IRS collect the correct amount of tax, but because they 
encourage voluntary compliance. These efforts to improve compliance help 
assure the public that when they are paying their taxes, everyone else is paying 
their fair share as well. Small business owners, for example, should feel 
confident that when they properly report their cash receipts, other businesses are 
doing the same. Likewise, the average person who can’t afford high-priced , 
financial advice should feel confident that the very wealthy are not able to hide 
their money in foreign countries and avoid paying tax on those assets. 

This sense of fairness is the underpinning of our system of voluntary compliance. 
Year after year, the IRS Oversight Board studies taxpayer behavior, and it has 
consistently found that the vast majority of people -- about three quarters of those 
surveyed - believe paying taxes is their civic duty. An even higher percentage of 
those surveyed believe it is not acceptable to cheat on their taxes. To maintain 
this sense of responsibility and fairness, we must continue doing everything we 
can to improve overall tax compliance. 
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But as I noted earlier in this testimony, the IRS’ budget situation represents a 
very serious challenge to our ability to continue making progress on this front. In 
order to keep up our efforts, the agency needs to have adequate funding, and I 
am deeply concerned about the impact of the reductions in our funding over the 
last several years. 

Just over a month ago, the agency’s Fiscal Year (FY) 2015 budget was set at 
about $10.9 billion, which is $346 million less than FY 2014. But this actually 
amounts to a total reduction of almost $600 million from last year, when another 
$250 million in mandated costs and inflation that we must absorb are counted. 

Further, the reduction I just described is on top of another $600 million cut the 
IRS had already taken as a result of government-wide sequestration in 2013. 
Congress ended up reversing most of those government-wide cuts, so that 
nearly every major federal agency was restored to the pre-sequester level, 
except for one: the IRS. The result is that the IRS is essentially two sequesters 
ahead of all other major government agencies. 

The IRS is now at its lowest level of funding since FY 2008. If inflation is taken 
into account, however, the current funding level is comparable to that of 1998. 
Since then, the number of individual and business tax filers has increased by 
more than 30 million, or 23 percent. 

In order to absorb the most recent reductions in our budget, the IRS has taken a 
number of difficult steps, including enforcement cuts of more than $160 million for 
FY 2015, and we estimate the agency will lose about 1,800 enforcement 
personnel through attrition during this fiscal year. We anticipate the result of 
these cuts will be fewer audit and collection cases. Specifically, we expect there 
will be at least 46,000 fewer individual and business audit closures and more 
than 280,000 fewer Automated Collection System and Field Collection case 
closures. 

We estimate that, as a result, the government will lose at least $2 billion in 
revenue that othenwise would have been collected. In addition to the revenue 
loss to the government, the curtailment of enforcement programs is extremely 
troublesome because these programs help create a deterrent effect that is the 
key to preserving high levels of voluntary compliance. 

The President’s 2016 Budget provides $12.3 billion in base discretionary 
resources, an increase of $1.3 billion from FY 2015, to make strategic 
investments in the IRS to continue modernizing our systems, improve service to 
taxpayers, and reduce the deficit through more effective enforcement and 
administration of tax laws. The Budget also proposes a $667 million cap 
adjustment to support program integrity efforts aimed at restoring enforcement of 
current tax laws to acceptable levels and to help reduce the tax gap. This multi- 
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year effort is expected to generate $60 billion in additional revenue over the next 
ten years at a cost of $19 billion, thereby reducing the deficit, if enacted, by an 
additional $41 billion. 

Chairman Chaffetz, Ranking Member Cummings, and Members of the 
Committee, thank you again for the opportunity to discuss the tax gap and IRS 
efforts to improve tax compliance. This concludes my statement, and I would be 
happy to take your questions. 
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Commissioner John Koskinen 

John Koskinen is the 48th IRS Commissioner. As Commissioner, he presides over the 
nation’s tax system, which collects approximately $2.4 trillion in tax revenue each year. 
This revenue funds most government operations and public services. Mr. Koskinen 
manages an agency of about 90,000 employees and a budget of approximately $1 1 
billion. 

In his role leading the IRS, Mr. Koskinen is working to ensure that the agency maintains 
an appropriate balance between taxpayer service and tax enforcement and administers 
the tax code with fairness and integrity. 

Prior to his appointment, Mr. Koskinen sen/ed as the non-executive chairman of Freddie 
Mac from 2008 to 2012 and its acting chief executive officer in 2009. Previously, Mr. 
Koskinen served as President of the U.S, Soccer Foundation, Deputy Mayor and City 
Administrator of Washington D.C., Assistant to the President and Chair of the 
President's Council on Year 2000 Conversion and Deputy Director for Management at 
the Office of Management and Budget. Mr. Koskinen also spent 21 years in the private 
sector in various leadership positions with the Palmieri Company, including President 
and Chief Executive Officer, helping to turn around large, troubled organizations. He 
began his career clerking for Chief Judge David L. Bazelon of the DC Circuit Court of 
Appeals in 1 965, practiced law with the firm of Gibson, Dunn and Crutcher and served 
as Assistant to the Deputy Executive Director of the National Advisory Commission on 
Civil Disorders, also known as the Kerner Commission. Mr. Koskinen also served as 
Legislative Assistant to New York Mayor John Lindsay and Administrative Assistant to 
Sen. Abraham Ribicoff of Connecticut. 

Mr. Koskinen holds a Law Degree from Yale University School of Law and a Bachelor’s 
Degree from Duke University. He also studied International Law for one year in 
Cambridge, England. He and his wife Patricia have two grown children and live in 
Washington, DC. 
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Chairman Chaffetz. Mr. Estevez. 

STATEMENT OF HON. ALAN F. ESTEVEZ 

Mr. Estevez. Thank you, Chairman Chaffetz, Ranking Member 
Cummings, members of the committee. Appreciate the opportunity 
to appear before you to discuss a couple of the areas of high risk 
identified by GAO, specifically supply chain management and 
weapons acquisition. 

The Department of Defense has made measurable progress in ad- 
dressing these areas as well as in the areas of contract manage- 
ment, as Mr. Dodaro mentioned, and infrastructure. The Depart- 
ment is dedicated toward improving our supply chain and acquisi- 
tion processes to ensure effective support for our warfighters and 
value to the American taxpayer. 

Supply chain management and weapon system acquisition are 
complex areas that, by their nature, entail some level of risk. We 
develop and field the best weapon systems in the world, and our 
logistics capability is unparalleled, as demonstrated in the last 13 
years of war. However, due to the scale and complexity of these 
functions inside the Department of Defense, even at six Sigma lev- 
els of tolerance, there will be some deficiencies. Therefore, we must 
continually strive to improve. 

Today the DOD supply chain is simultaneously sustaining forces 
in Afghanistan, supporting the war on ISIL, and completing the 
mission to control Ebola. At the height of operations in Afghani- 
stan, we provided 1.1 million gallons of fuel and 435,000 meals a 
day, delivered medical supplies, construction materials, and spare 
parts to sustain our combat power at record levels of readiness. 
DOD manages over 5 million items valued at over $90 billion. Our 
actions to improve inventory performance while maintaining over- 
arching focus of reducing risks to our warfighters have produced 
substantial results that have been acknowledged by GAO. For ex- 
ample, since 2010, DOD has been implementing our comprehensive 
inventory management improvement plan. Since 2012, we’ve re- 
duced government-managed inventory by $14.4 billion, the first re- 
duction in government inventory since the 1990’s. DOD is imple- 
menting a new forecasting methodology, which is producing im- 
proved material availability, decreased back orders, and reduced 
procurements. With that said, there is more work to be done on im- 
proving our supply chain performance and we remain focused on 
doing so. 

Second area of high risk that I want to address is weapon system 
acquisition. It is important to recognize that the weapon system ac- 
quisition process has provided the United States with dominant 
military capabilities. The rise of foreign capability, coupled with 
our ongoing combat operations, global commitments and our re- 
duced budgets is jeopardizing our technological superiority. Our 
weapon system acquisition process must deliver needed combat ca- 
pability to our warfighters as effectively as possible. Our program 
for continuous process improvement in this area that we call better 
buying power, or BBP, is focused on that goal. 

GAO’s and our own main concern in the acquisition area is cost 
and schedule of growth. Under BBP, the Department sets and en- 
forces affordability caps on all major weapon systems. We are 
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tracking performance against established caps to ensure compli- 
ance. Affordability caps tied to requirements. BBP drives active en- 
gagement between the acquisition and requirements leadership, 
that would be the operator who uses the weapon system, during 
weapon system development to ensure that requirements associ- 
ated with the program address the warfighter needs in a cost effec- 
tive, affordable way. 

We revised our principal acquisition policy, DOD Instruction 
5002, which formally institutionalizes BBP and the improvements 
resulting from the Weapon System Acquisition Reform Act, includ- 
ing emphasis on systems engineering, cost analysis, and testing. In 
addition to the actions already mentioned, we are formally meas- 
uring our own performance. The first two annual reports on the 
performance of the defense acquisition issue — acquisition system 
have provided data that the Department is using to increase the 
performance of the acquisition process, and GAO is also using those 
reports. 

In summary, DOD will continue to work with the GAO to ad- 
dress the underlying root causes that have resulted in our high- 
risk designation. We are and continue to be focused on removing 
ourselves from this list by correcting our deficiencies for the benefit 
of our warfighters and the taxpayer. 

Thank you for the opportunity, and I look forward to your ques- 
tions. 

Chairman Chaffetz. Thank you. 

[Prepared Statement of Mr. Estevez follows:] 
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Chairman Chaffetz, Ranking Member Cummings, Members of the Committee, thank you for the 
opportunity to appear before you to discuss the efforts we have taken to address GAO’s identified areas 
of high risk. The Defense Department has made significant and measurable progress in the two years 
since the last GAO high risk report, and my testimony today reflects our continued dedication toward 
improvements that provide effective support for our deployed warfighters and provide value to the 
American taxpayers who pay for that support. I appreciate the Committee’s interest and support of the 
Department’s mission. 

Introduction 

The Department has developed a close working relationship with the GAO and continues to be 
fully engaged in the process for removal of each area from the high risk list. GAO’s process for 
removing an item from the High Risk List includes five key elements; top leadership support and 
demonstrated strong commitment, the capacity to address the high risk areas, developing corrective 
action plans, monitoring corrective measures, and demonstrating progress resulting from implementing 
the corrective measures. 

Today, I would like to discuss two of the areas that have been assessed by GAO as high risk for 
the Department: supply chain management and weapon systems acquisition. These are complex areas 
that by their nature entail some level of risk. We develop and field the best weapon systems, and our 
logistics capability is unparalleled, as demonstrated by our logistics successes in the 1 3 years of war. 
However, even at six sigma tolerance, there will be deficiencies. We agree that we can and should 
continually strive to improve for the benefit of our warfighters and the taxpayers. 

I will highlight concrete actions taken to address the high risk designations in the areas of supply 
chain management and weapon systems acquisition. 

Supply Chain Management 

The DoD supply chain is unparalleled in the scope of its operations and complexity of its 
mission. Our mission is to provide globally responsive, operationally precise, and cost effective joint 
logistics support for the combat power projection and sustainment of America’s warfighter. The over 1 
million uniformed, civilian, and contract employees who support all aspects of the Department’s supply 
chain keep 16,000 aircraft, 600 ships, and 40,000 combat vehicles capable of fulfilling their mission. 
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Every day, DoD logisticians support troops deployed in some of the world’s most demanding 
environments, and they are frequently called upon to support operations on short notice in parts of the 
world where we have little or no presence. The ability of DoD’s supply chain to support these 
warfighters is our most important measure of success. Most notably today, DoD logisticians are key 
enablers to simultaneously executing the sustainment of forces in Afghanistan, supporting the war on 
ISIL, and providing support in the mission to control Ebola. At the height of operations in Afghanistan, 
we provided 1,1 million gallons of fuel a day for both U.S. and coalition forces while feeding 435,000 
meals a day to the U.S. Service personnel and civilians on the ground, as well as delivering the needed 
sustainment in medical, construction materials, clothing, and spare parts. We also rapidly fielded more 
than 12,000 mine-resistant ambush-protected (MRAP) vehicles to Afghanistan to protect our forces as 
they performed their mission, and we sustained the readiness of these vehicles in austere conditions at 
levels over 90%. In addition to delivering warfighter sustainment, we executed the drawdown of forces, 
equipment, and supplies. From the high water mark in January' 2012 to January 2015, we reduced over 
38,000 vehicles and 27,000 containers of supplies and equipment, and closed or transferred 343 US 
bases. We donated $284 million (depreciated value) of excess property to the Afghan government, 
improving their capacity while avoiding transportation cost in excess of $2.2B. 

At the same time that we have been providing unwavering support to our deployed warfighters, 
we have also responded to multiple and complex humanitarian relief and disaster assistance efforts 
around the world, with little or no warning. Those responses are another measure of our success. 

Even with these enormous challenges, we continue to make substantial and measurable 
improvements to mitigate the high-risk designation. 

Inventory Management 

DoD manages over five million inventory items valued at more than $90 billion. GAO’s 
assessment cited the Department for buying and managing more inventory than needed and buying 
inventory far in advance of its use. The Department manages inventory in such a way as to reduce risk 
for our warfighters. Recent DoD actions to improve performance have produced substantial results 
which have been reviewed and acknowledged by the GAO. 

For example, DoD developed the Comprehensive Inventory Management Improvement Plan in 
FY2010 to establish specific process and outcome goals and to inculcate a culture change of “Don’t buy 
what is not needed” and “Don’t keep what is not used”. 
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Within that plan, we have accelerated our review processes and established these reviews at 
senior levels. We have reduced government-managed inventory by $I4.4B since 2012 - the first 
reduction in government-managed inventory since the late 1990s. Additionally, the Department 
identified and brought to record in government inventorj’ systems $8.7B of government owned - 
contractor managed inventory. We have reduced inventory being held for potential reuse by $4.3B, and 
we have reduced buying potential inventory far in advance of the need by $816M since 2010. 

Perhaps the most significant change going forward is in demand forecasting. DoD is implementing 
a new forecasting methodology for inventory with demand patterns that are infrequent or highly 
variable. This initiative is producing improved materiel availability, decreased backorders, reduced 
procurement orders, and on-hand inventory results. 

Asset Visibility 

The Department has achieved significant progress in providing asset visibility to improve 
support to the warfighting customer, leveraging automatic identification technology in the logistics 
business area. We operate the world’s largest active radio frequency identification (RFID) network, 
providing visibility of unit cargo and sustainment materiel transiting 41 countries, with 1 ,990 tag 
read/write sites and more than 1 ,420 satellite tracking sites. Passive RFID is being used to provide 
visibility of and accountability for principal end items and containers moving within a base, and for 
inventory of uniform items issued at Service recruit training facilities. We are seeing reductions in 
inventory cycle times from 1 0 days to 1 0 hours, stock pick times from approximately two hours to near- 
real time, uniform issue times for new recruits from 2.5 hours to 55 minutes, and receipt processing 
times from two hours to one. The U.S. Marine Corps’ Non-nodal In-transit Visibility for the Last 
Tactical Mile provides near-real time visibility of sustainment cargo during the tactical level battlefield 
distribution process, while the Air Force uses Real Time Location System technology to track aircraft 
and critical assets, leading to a 35% reduction in depot flow time. 

Last year, the Department published the “Strategy for Improving DoD Asset Visibility”, creating 
a framework whereby the Department can build on efforts to date and further improve asset visibility. 
These efforts will inform our oversight and will expand use of automatic identification technology to 
improve data capture, integration, analysis, and supply chain execution. We are working with industry 
leaders to review best practices and lessons learned in the use of this technology. 
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Materiel Distribution 

The Department has established 23 enterprise metrics to evaluate the materiel readiness, 
responsiveness, reliability, cost, and planning and precision of the supply chain. With respect to 
material distribution, we are measuring the effectiveness of the system, and are continuing our efforts to 
improve our data analysis. Where we are not meeting our goals, we are identifying corrective actions, 
and monitoring results of those actions. There is more work to be done on improving supply chain 
management, but we continually improve our performance and validate existing goals. 

Weapon Systems Acquisition 

The second DoD high risk area identified on GAO’s inaugural list is weapon systems 
acquisition. As with supply chain management, it is important to recognize that the weapon systems 
acquisition process has provided the United States with dominant military capabilities relative to any 
potential adversary. 

The combination of on-going combat operations, global U.S. commitments, and reduced 
budgets -especially if we return to sequester levels of funding- significantly impacts U.S. investment in 
new technology and weapon systems. The rise of foreign capability, coupled with the overall decline in 
U.S. research and development investments, is jeopardizing our technological superiority. The Defense 
Department has to balance among many competing requirements, and the goal of DoD weapon system 
acquisition is to use available resources as efficiently and effectively as possible to deliver needed 
capability to our warfighters. DoD actions to address the GAO high risk assessment remain consistent 
with that goal. Here are some of the steps we are taking to accomplish this. 

We are steadfast in our actions to reduce cost growth, prevent schedule delays, and obtain belter 
performance from our weapon systems. A recent study found statistically significant correlation 
between cost increases in weapons systems and the budget situation at the time the program was first 
baselined,' Program cost overruns are much more pronounced if the program was initiated during 
periods of “tight” money, such as we are currently experiencing. Therefore, we must be diligent and 
realistic as we manage programs. 


McNicol, David L., and Linda Wu, Evidence on the Effect of DoD Acquisition Policy and Process 
On Cost Growth of Major Defense A cquisition Programs, Institute for Defense Analyses, Paper P-5126. September 2014 
http://www.dtic.mil/dtic/tr/fuUtext/u2/a609472.pdf 
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During the past five years the department has been engaged in a process of continuous 
improvement that we call “Better Buying Power” (BBP). While Better Buying Power is comprised of 
many individual initiatives, I wanted to highlight a few that I believe are fundamental to today’s 
discussion. 

Affordability 

The first area of GAO concern is aflbrdability. Under Better Buying Power, the Department sets 
and enforces affordability caps on all major programs. Affordability caps help us determine how much 
capability can reasonably be afforded in future budgets. Before requirements are established and before 
programs are initiated, affordability analysis is used to establish production and sustainment 
affordability caps. We are tracking our performance against the established caps to ensure compliance. 

Requirements 

The affordability caps tie to a second GAO concern for weapon systems acquisition, 
requirements. Better Buying Power drives active engagement between the acquisition and requirements 
leadership during the development and review of proposed requirements trades. This is essentia! to 
ensuring that the requirements associated with the program address the warfighters needs in a cost 
effective and affordable way. Our policies require the acquisition leadership to actively participate in 
the requirements authorities review to ensure, before final approval, that the requirements are 
achievable, affordable, and testable and that requirements are fully informed by systems engineering 
trade-off analysis. 

While implementing and learning from the Better Buying Power initiatives, we have also revised 
our principal acquisition policy, DoD Instruction 5000.02. The policies I have already mentioned are 
formally implemented by the revised instructions. 

The instruction also makes two important changes to improve cost and schedule outcomes. It 
adds a Requirements Decision Point to implement the vita! dialogue between the requirements and 
acquisition communities. It also adds a Development Request-for-Proposal Decision Point to ensure 
that the program business arrangements and contracting strategies are consistent with requirements and 
affordability caps before proceeding with significant long term investments. 
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The update to DoDl 5000.02 also formally institutionalizes and emphasizes the important 
acquisition policy improvements resulting Irom the Weapon Systems Acquisition Reform Act, including 
increased emphasis on systems engineering, cost analysis, and testing. 

As we rewrote DoDl 5000.02, we noted the significant number of statutory and regulatory 
requirements imposed on our program managers. We are taking steps to reduce part of this burden via 
proposed changes to regulation that will simplify the statute without sacrificing the intent. 

Consequently, we have been working closely with Congressional leadership and staff and we are 
submitting a legislative proposal timed for review and inclusion in the FY 201 6 National Defense 
Authorization Act. 

Tracking Performance 

In addition to the actions already mentioned, we are formally measuring our own performance. 
Our objective is to gather data and understand the causes of good and bad results and correlate that with 
our policies. The first two “Annual Reports on the Performance of the Defense Acquisition System” 
identify the relationships between factors the department can affect and outcomes we are trying to 
achieve. 

The improvements to acquisition outcomes that we believe can be achieved via the Better 
Buying Power initiatives and the changes to DoDl 5000.02 will not be possible without our acquisition 
workforce. Our acquisition professionals have hard, technical jobs that require a unique body of 
knowledge and advanced problem solving skills. We added workforce professionalism as a major 
category in Better Buying Power 2.0 to ensure this area received sustained leadership attention. 

The department leadership remains firmly committed to ensuring that we have the capacity and 
resources necessary to attain improved acquisition outcomes. We are leveraging Better Buying Power 
initiatives to improve our performance and we monitor the effectiveness of our actions via our program 
decision reviews and the senior-level BBP progress reviews. We continue our annual reviews of the 
performance of the acquisition system, including assessing process and cost growth metrics to monitor 
our progress. 
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Conclusion 

In summary, DoD will continue to work with GAO to address the underlying root causes that 
have resulted in our high-risk designation and we will implement solutions to those identified problems. 
While these two areas I have discussed today are complex, we are committed to continuous 
improvement for the benefit of our w'arfighters and the taxpayers. 

Thank you again for this opportunity to discuss GAO’s 2015 high risk list. I look forward to 
answering your questions. 
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Chairman Chaffetz. Mr. MacWilliams. 

STATEMENT OF JOHN MACWILLIAMS 

Mr. MacWilliams. Thank you, Chairman Chaffetz, and Ranking 
Member Cummings, members of the committee. I appreciate the 
opportunity to appear before you today to discuss the Department 
of Energy’s efforts at improving our management of our capital 
asset projects. This is a topic of great importance to Secretary 
Moniz and our Deputy Secretary Sherwood-Randall. 

DOE manages some of the largest most complex and technically 
challenging projects in either the public or the private sector due 
to its diverse mission. The portfolio of large projects undertaken by 
DOE is unique not only from other projects in the public and pri- 
vate sectors but also each DOE project is unique from other DOE 
projects. These projects are truly one of a kind with uncommon 
challenges, such as handling radioactive conditions or producing 
extremely bright X-rays for nano science. In light of these chal- 
lenges, DOE has historically struggled with project and contract 
management, and we have been on the GAO’s high-risk list since 
the list’s inception in 1990. 

We have made some important progress, however, that has been 
recognized by GAO and others. In 2009, we were removed — the 
GAO removed the Office of Science from the high-risk list, and in 
2013, GAO again narrowed its DOE focus to projects over $750 mil- 
lion in the Department’s Office of Environmental Management and 
the National Nuclear Security Administration. The Department re- 
mains very focused on getting off this list entirely. To meet this 
challenge, the secretary is instituting changes to improve depart- 
mental performance on major projects, and one of the first actions 
he took when he became Secretary was to create an Under Sec- 
retary for management and performance to focus specifically on im- 
proving project management and providing direct supervision of 
many of DOE’s most challenging projects. 

In August 2013, the Secretary also established a working group 
which he asked me to lead to conduct an in-depth analysis of 
project management. This working group was comprised of DOE’s 
senior-most project management experts, and we took a very com- 
prehensive look at the challenges that DOE faces, and the group 
provided opinions as to why projects either fail or succeed in the 
DOE environment. The working group’s findings were issued in a 
report which was released in Ilecember, and that report you can 
find on our Website at the Department of Energy. 

The report led to several recent — implementation of several ef- 
forts to improve project management. Eirst, we strengthened the 
Energy Systems Acquisition Advisory Board. We will now review 
all projects with an estimated cost of $100 million and up. Used to 
be we only looked at 750 million and up, and the board, which is 
chaired by the Deputy Secretary and comprised of the senior-most 
departmental officials, will now meet at least quarterly and will 
focus on projects that are deemed to be at risk of not meeting their 
performance baselines. 

Second, we have established a new committee, the Project Man- 
agement Risk Committee. This is comprised of the senior project 
managers who are the same folks that wrote the report that I just 
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referenced, and that is providing risk assessment and advice to the 
Department’s senior leadership, reviewing and analyzing projects 
before all critical decisions and baseline change proposals, and pro- 
viding peer reviews and in-house consulting to projects across the 
Department. 

Finally, the Secretary has taken a series of actions aimed at im- 
proving lines of responsibility and improving our peer review proc- 
ess. The Department is improving accountability by ensuring that 
for each project, the appropriate Under Secretary must now des- 
ignate a clear owner who has budgetary and programmatic respon- 
sibility. There must also be a clear line of responsibility that ex- 
tends from the Under Secretary to the project owner to the Federal 
project director. In addition, where it doesn’t exist already, each 
Under Secretary is now establishing a project assessment office. 

The reforms and processes that we are instituting at DOE with 
respect to project management are critical steps to meet our solemn 
responsibility to be responsible stewards of taxpayer dollars. We 
are encouraged by the work that has been done over the last year 
which has been focused on effecting permanent, structural and cul- 
tural change in the way that the Department manages its projects. 

Thank you. I would be pleased to answer your questions. 

Chairman Chaffetz. Thank you. 

[Prepared Statement of Mr. MacWilliams follows:] 
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Thank you Chairman Chaffetz, Ranking Member Cummings, and Members of the Committee, 1 
appreciate the opportunity to appear before you today to discuss the Department of Energy’s 
efforts at improving the management of its capital asset projects, which is a topic of great 
importance to the Secretary and Deputy Secretary. 

The Department has been focused on improving project management and has made progress. In 
particular, the Secretary has made improvement of management and performance at the 
Department of Energy a top priority. The focus on this area spans from the management of our 
National Laboratories to project management of major capital investments, which is the topic of 
my testimony before you today. 

Evolution of the Department of Energy’s Mission 

When the Department of Energy was originally formed, it was the progeny of more than 50 
organizations from around the Federal government. The new Department brought together 
offices that were previously housed in the Departments of Agriculture, Commerce, Interior, 
Housing and Urban Development, and Transportation and absorbed the Federal Energy 
Administration, Energy Research and Development Administration, and other organizations 
entirely. 

The Department took on the sprawling scientific and industrial nuclear complex under the 
Atomic Energy Commission, The Department also assumed responsibility for massive nuclear 
cleanup projects across the country. In response to the oil shocks of the 1 970s, U.S. energy 
policy at the time was designed to protect energy consumers through oil price and allocation 
controls, establishing national oil reserves, and working to develop new energy technologies. 

Today, the means by which the mission is achieved have clearly evolved. For instance, 
maintaining a safe, secure, and effective stockpile is no longer supported by nuclear weapons 
tests. The Department of Energy (DOE) now uses high performance computers and other 
advanced technology to analyze each of the mechanisms of a weapon at a level of detail that was 
never available during the era of nuclear testing. In fact, our laboratory directors believe they 
actually understand more about how nuclear weapons work now than during the period of 
nuclear testing. 

Far from the oil shortages of the 1 970s, the United States today enjoys an era of relative energy 
abundance. Our country is now the world’s leading producer of oil and natural gas. This energy 
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revolution is driving down our dependence on imported oil to its lowest level since 1968. Barely 
a decade ago, the United States imported 60 percent of the crude oil used. Now, within the year, 
the United States is on track to import only 20 percent. 

From our efforts to find affordable and clean energy sources, to underpinning the United States 
basic research enterprise, to ensuring the security of our nuclear stockpile and reducing the 
global nuclear danger, to cleaning up the legacy of the Cold War — the Department’s work 
today remains essential to this nation’s prosperity, environment, and security. However, far too 
often we continue to find ourselves stuck with the same institutional stovepipes and outdated 
management practices that date back to the Department’s founding. 

To meet our mission, DOE manages some of the largest, most complex, and technically 
challenging projects in either the public or private sector. This includes 36 projects valued at 
over $100 million. These range from our Office of Science projects such as the Spallation 
Neutron Source located at Oak Ridge National Laboratory, which provides the most intense 
pulsed neutron beams in the world for scientific research and industrial development — to the 
Office of Environmental Management (EM), which is responsible for the environmental 
remediation of sites involved in the Nation’s nuclear-weapons production complex. 

GAO High-Risk List 

The portfolio of large projects undertaken by the Department of Energy is not only unique from 
other projects in the public and private sector, but each DOE project is unique from other DOE 
projects. These diverse capital projects are truly one-of-a-kind, with uncommon challenges such 
as handling radioactive conditions or producing extremely bright x-rays for nanoscience. In light 
of these challenges, the Department has struggled with project and contract management, with 
too many projects going over budget and taking longer than originally planned. 

The Department has been on the Government Accountability Office’s (GAO) “High-Risk List,” 
since the list’s inception in 1990. This list and its associated documentation identify problematic 
projects and suggest changes in government management and contract administration to mitigate 
these problems. However, I am pleased to say that we have made some important progress that 
has been recognized by the Government Accountability Office and others. In 2009, the GAO 
removed the Office of Science from the High-Risk list. In 2013, GAO again narrowed its DOE 
focus to contracts and projects over $750 million in the Department’s Office of Environmental 
Management and National Nuclear Security Administration (NNSA). We expect GAO’s 201 5 
update to focus again on these large contracts and projects in EM and NNSA. However, the 
Department remains focused on getting off the list entirely. 

Project Management Reform 

To meet this challenge, the Secretary is instituting changes to improve the Department’s 
performance on major projects across the DOE enterprise on several tracks. One of the first 
actions the Secretary took was to reorganize the Department at the Under Secretary level to 
create an Under Secretary for Management and Performance focused specifically on improving 
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project management and performance and bringing EM, the Office of Legacy Management and 
the Office of Management under the purview of this new Under Secretary. 

The Secretary also made it a priority to recruit senior advisors who report directly to him and 
who bring management and business experience to the Department. I have a private sector 
background and have focused on investment and financing in the energy sector since the mid- 
1980s. I joined the Department in June 2013 as a Senior Advisor to the Secretary and serve as 
the senior finance advisor and a member of the national security team. 

Shortly after I joined the Department, the Secretary asked me to lead a new working group that 
he established in August 2013 to conduct an in-depth analysis of project management. This 
working group, which was comprised of senior project management experts from program 
offices across the Department, took a comprehensive look at the challenges that the Department 
faces and provided its candid opinions on why projects either fail or succeed in the DOE 
(including NNSA) environment. The working group also examined case studies to determine 
what lessons could be learned from the Department’s successes and failures in project 
management. 

The working group’s findings were issued in a report titled, “Improving Project Management” 
that was released last month and is available online at http://energy.gov/articles/improving- 
project-management-department-energy. The report was evaluated by senior leadership, which 
led to the implementation of the following efforts to improve project management: 

• Strengthening the Energy Systems Acquisition Advisory Board 

• Establishing a Project Management Risk Committee 

• Improving the Lines of Responsibility and the Peer Review Process 

I will discuss each of these recommendations and also what the Department is doing to ensure 
that we improve project management. 

Energy Systems Acquisition Advisory Board 

One of the insights that became clear through the analysis is the need for a Department-wide 
perspective on individual projects. There is also a clear need for senior leadership to be directly 
involved in the oversight of major capital asset projects. 

Accordingly, we are strengthening the Energy Systems Acquisition Advisory Board or 
“ESAAB.” This board is comprised of the Department’s most senior leaders and chaired by the 
Deputy Secretary. 

ESAAB was originally charged with overseeing all projects larger than $750 million and making 
recommendations to the Deputy Secretary. However, as the number of large projects has 
decreased over the years, the number of ESAAB meetings has correspondingly dwindled. For 
example, before the Salt Waste Processing Facility ESAAB meeting in August 2014, it had been 
two and half years since the group had last convened. 
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Through these changes, we are strengthening the board from an ad hoc body, to a dynamic 
organization that will meet quarterly at a minimum. The ESAAB will now review all projects 
with an estimated cost of greater than $ 1 00 million, with a specific focus on projects that are 
struggling to meet performance baselines. 

Project Management Risk Committee 

The Energy Systems Acquisition Advisory Board will be supported by a new Project 
Management Risk Committee comprised of the Department’s top project management experts. 
These project management experts are the same people who spent a year developing key project 
management recommendations and writing the “Improving Project Managemenf’ report. 

The Project Management Risk Committee will provide risk assessment and advice to the 
Department’s senior leadership. It will also review and analyze projects before all critical 
decisions and baseline change proposals and provide peer reviews and in-house consulting to 
projects across the entire Department. The committee will meet twice a month at a minimum 
and focus on projects with a budget of $100 million or more. The committee’s first order of 
business is to review the recommendations in the “Improving Project Management” report and 
recommend specific actions to the Secretary within 60 days. 

Improving the Lines of Responsibility and the Peer Review Process 

Unclear ownership creates a culture where everyone is in charge, but no one is responsible for 
holding contractors accountable for results. It is critical that a single manager has responsibility 
over a project and is empowered to ensure that the venture is effectively executed. 

Going forward, the Department is improving accountability by ensuring that for each project the 
appropriate Under Secretary will now designate a clear owner who has budgetary and 
programmatic responsibility. There must also be a clear line of responsibility that extends from 
the Under Secretary to the project owner to the Federal Project Director. 

Where it does not already exist, each Under Secretary is now establishing a Project Assessment 
Office that does not have line management responsibility for project execution. These offices 
will have direct access to senior Department officials and will conduct annual peer reviews of 
projects over $100 million or lower when appropriate. This process is based on the highly 
successful peer reviews in DOE’S Office of Science. The Secretary has mandated that all of 
DOE’S programs have a similar process in place. 

Immediate Action 

There are also several other recommendations from the project management working group’s 
report that the Secretary has already tasked the Department’s leadership with implementing. 

First, the Department will now request full funding in a single fiscal year for all new projects 
under $50 million, unless there is justification to make an exception. Full funding in a single 
fiscal year increases the opportunity for performance-based fixed price contracts, which in turn 
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increase accountability and the likelihood of achieving baseline goals. When full funding in a 
single fiscal year is not obtained and extends over multiple fiscal years, as the Department has 
seen time and time again, the result is often poor planning, higher acquisition costs, cancellation 
of projects, and the resulting loss of sunk costs. 

Second, for all projects over $50 million, program offices must now conduct an alternatives 
analysis that is totally independent of the contractor organization responsible for the project. 
This will ensure that the Department has an unbiased perspective on all alternatives before 
committing to a particular project. 

Finally, the Department will establish a project management leadership institute to create and 
sustain a culture of project management excellence across the entire enterprise. We plan to 
engage our key stakeholders to help us think through the creation of the institute and the 
coursework that we put forward. 

Conclusion 

As public servants, we have a solemn responsibility to be responsible stewards of taxpayer 
dollars. The reforms and processes we are instituting at the Department of Energy with respect 
to project management are critical steps to ensuring that we meet this responsibility. We are 
encouraged by the work done over the last year toward this effort, and now our focus is on 
making sure that we effect permanent improvements through our execution of projects. 

Thank you. I am pleased to answer your questions. 
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Chairman Chaffetz. Members should be advised that there is a 
vote on the floor. We have three votes. The intention is to have the 
next two gentlemen give their opening Statements, but we will not 
get to questions until after votes. So we anticipate that that will 
happen no sooner than 5:15. Each of you two gentlemen have up 
to 5 minutes, but please be swift, and your full Statements will be 
entered into the record. Doctor. 

STATEMENT OF SHANTANU AGRAWAL, M.D. 

Dr. Agrawal. Thank you. Chairman Chaffetz, Ranking Member 
Cummings, and members of the committee, thank you for the invi- 
tation to discuss the Centers for Medicare and Medicaid Services’ 
operation of these programs. 

We share this committee’s commitment to protecting bene- 
ficiaries’ and taxpayers’ dollars and to preserving these program for 
generations to come. CMS appreciates the work of the GAO. Medi- 
care is a large and complex program serving 54 million bene- 
ficiaries and working with over 1.5 million providers. We pay over 
one $billion claims per year from these providers. While the GAO 
continues to classify Medicare as a high-risk program, there is good 
news to report. The last 2 years saw the slowest growth in real per 
capita national healthcare expenditures on record. The 2014 Medi- 
care trustee’s report projects that the trust fund which finances 
Medicare’s hospital insurance coverage will remain solvent until 
2030, 4 years beyond what was projected just last year. They are 
also promising improvements in the quality of care furnished the 
beneficiaries. CMS initiatives have contributed to an estimated 
50,000 fewer patient deaths in hospitals, and 1.3 million fewer hos- 
pital-acquired conditions, saving $12 billion over 3 years. Medical 
review strategies have resulted in over $5 billion of savings in just 
last fiscal year. 

CMS is working to transform Medicare into a high-value payer 
with payment policies based on quality not just volume, and we re- 
main focused on preventing waste, abuse, and fraud before it oc- 
curs. These issues are not merely about cost. They threaten bene- 
ficiary health through unnecessary services, substandard care, dan- 
gerous prescribing, and a host of other problems. Since 2011, CMS 
has been using its fraud prevention system to apply advanced ana- 
lytics on all Medicare fee-for-service claims. The system also incor- 
porates beneficiary complaints made through 1-800-MEDICARE, 
and works with numerous other inputs to generate and prioritize 
leads for further review and investigation. CMS then swiftly takes 
administrative action to stop problematic behaviors through the 
suspension of payments, medical review of claims, and removal 
from the program. As we recently reported to Congress, our ad- 
vanced analytic system has already generated a 5 to 1 return on 
investment. 

Another component of our efforts is to strengthen provider enroll- 
ment by verifying the legitimacy of new or existing Medicare pro- 
viders through a risk-based approach. We are screening those that 
pose the highest risk to the program using routine data checks over 
licensure and criminal records, scheduled and unscheduled site vis- 
its, and fingerprinting. As a result, we have removed over 450,000 
Medicare enrollments since 2010, and importantly denied thou- 
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sands of enrollment applications, which means that these providers 
never gained the ability or lose the ability to build a Medicare pro- 
gram. These unprecedented examples of success have been posi- 
tively acknowledged by GAO. 

Additionally, we are engaging with the private sector in new 
ways to better share information and transform insights into ac- 
tion. The Healthcare Fraud Prevention Partnership is currently 
made up of 38 private. Federal, and State members, and continues 
to gain membership. The partnership has completed studies that 
led partners to take substantive actions, and is developing addi- 
tional studies based on these results. The President’s FY-16 budget 
includes a proposal to allow both public and private partners to 
support this partnership by providing funds. Beyond the partner- 
ship, CMS has made important progress in integrating proven pri- 
vate sector tools in our operations, including advanced predictive 
analytics, prior authorization, and the use of automated prepay- 
ment claims edits. These initiatives net million — hundreds of mil- 
lions of dollars in savings every year. 

Finally, CMS is focused on moving the Medicare program away 
from the misaligned incentives of fee-for-service reimbursement, 
like paying the number of tests performed instead of paying for 
quality and outcomes. CMS is testing different payment models 
where providers are held accountable for the quality and cost of 
their care, and providers have a financial incentive to coordinate 
care for their patients. For the first time, HHS has also set explicit 
goals for this work. CMS has a goal of tying 30 percent of tradi- 
tional fee-for-service Medicare payments to quality through alter- 
native payment models by the end of 2016, and tying 50 percent 
by the end of 2018. As a physician myself, I ultimately care most 
about the health of patients, which I am reminded of daily as I 
work with CMS colleagues to improve the delivery of healthcare 
services. Our healthcare system should offer the highest quality 
and most appropriate care possible to ensure the wellbeing of indi- 
viduals and populations. 

I look forward to answering this committee’s questions, and I 
thank for the time. 

Chairman Chaffetz. Thank you. 

[Prepared Statement of Dr. Agrawal follows:] 
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U.S. House Committee on Oversight & Government Reform 
Hearing on 

GAO’s High Risk Report 
February 11, 2015 

Chairman Chaffetz, Ranking Member Cummings, and members of the Committee, thank you for 
the invitation to discuss the Centers for Medicare & Medicaid Services’ (CMS’) operation of the 
Medicare and Medicaid programs. We share this Committee's commitment to protecting 
beneficiaries and taxpayer dollars. Enhancing program integrity is a top priority for the 
administration and an agency-wide effort at CMS. As stewards of Medicare and Medicaid, two 
large, complex programs providing vital services to millions of Americans, CMS is making 
important strides in preserving Medicare and Medicaid for generations to come. 

Medicare has been deemed "high risk" by the Government Accountability Office (GAO) in part 
due to the sheer size and complexity of the program. CMS pays 1.5 million providers for health 
care for 54 million beneficiaries under the Medicare program. GAO has also designated 
Medicaid as a “high risk” program due to its size, growth, diversity of programs, and concerns 
about the adequacy of fiscal oversight, which is necessary to prevent inappropriate program 
spending. Additionally, the Office of Management and Budget has designated Medicare and 
Medicaid as "high priority" programs due to their annual improper payment rates, based on the 
annual dollar amount of improper payments relating to Medicare and Medicaid. 

CMS is using a multi-faceted approach to strengthen these programs by more closely aligning 
payments with the costs of providing care, encouraging health care providers to deliver better 
care and better outcomes for their patients, and improving access to care for beneficiaries. We 
have instituted many program improvements and are continuously looking for ways to refine and 
improve our program integrity activities. These efforts have already helped extend the life of the 
Medicare Trust Fund, with the most recent Medicare Trustees Report projecting that the trust 
fund that finances Medicare’s hospital insurance coverage will remain solvent until 20.30, four 
years beyond what was projected in the previous year’s report. 

To assist in CMS’ program integrity and program improvement activities, the President’s Fiscal 
Year (FY) 2016 Budget includes a package of Medicare legislative proposals that will save a net 
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$423 billion over 10 years. The Budget includes an additional $201 million in mandatory and 
discretionary investments in FY 2016 to address healthcare fraud, waste, and abuse. The Budget 
also proposes legislative changes to improve the long-term sustainability of Medicare and 
Medicaid by increasing the efficiency of health care delivery without compromising the quality 
of care for the elderly, children, low-income families and people with disabilities. 

Improving the Health Care Delivery System 

Since the implementation of the Affordable Care Act, Medicare has drastically reduced its 
growth in spending. The years 2011, 2012, and 2013 saw the slowest growth in real per capita 
national health expenditures on record, spurred by slow growth in per-beneficiary spending 
throughout our health care system, including Medicare, Medicaid, and private insurance. 
Medicare spending per beneficiary was approximately flat in FY 2014, and from 2010 to 2014, 
Medicare spending per beneficiary grew at a rate that was two percentage points less per year 
than growth in gross domestic product per capita. ' Looking forward, due primarily to the 
persistent slowdown in health care costs, the Congressional Budget Office now estimates that 
Federal spending on Medicare and Medicaid in 2020 will be $191 billion below the projections it 
made in August 2010. 

Progress toward a safer health care system is being made, and the quality of care furnished to 
beneficiaries has improved, due in part to provisions of the Affordable Care Act such as 
Medicare payment incentives and the Department of Health and Human Services (HHS) 
Partner.ship for Patients initiative. These efforts have contributed to an estimated 50,000 fewer 
patient deaths in hospitals and approximately $12 billion in health care cost-savings due to a 
reduction in hospital-acquired conditions from 2010 to 2013. Preliminary estimates also show 
that in total, hospital patients experienced 1.3 million fewer hospital-acquired conditions from 
2010 to 2013. This translates to a 17-percent decline in hospital-acquired conditions over the 
three-year period. In 2013 alone, almost 35,000 fewer patients died in hospitals, and 
approximately 800,000 fewer incidents of harm occurred, .saving approximately $8 billion." 


' hitp:/7www.cuis.eov/Newsrooni/McdiaReleaseDatabase/Facl-shcets/2015-Facl-shcels-iLems/201.S-01-26. hlml 
^ http://www.ahrq.gov/protessionals/quality-palient-safety/pfp/interimhacrate2013.html 
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Building on these successes, CMS has implemented numerous initiatives to improve quality, and 
reduce costs for Medicare and Medicaid beneficiaries by addressing improper payments, 
reducing veaste, fraud, and abuse, and examining alternative payment methods. In addition, the 
President’s FY 2016 Budget includes a package of proposals that are designed to encourage 
delivery system reform, including replacing the Medicare Sustainable Growth Rate Formula with 
annual payment updates and creating incentives for participation in high quality and efficient 
healthcare delivery systems. We will continue to gather and incorporate feedback from our 
many partners, including the GAO, as we move forward in strengthening Medicare and Medicaid 
and protecting beneficiaries. 

Refining Medicare Payment Methods to Encourage Efficient Provision of Services 

CMS is committed to reforming the Medicare payment system to provide predictable payments 
that incentivize quality and efficiency in a fiscally responsible way. Our efforts are focused on 
two main goals: (Ij ensuring payments emphasize high-quality, high-value care, and 
(2) developing and implementing proven payment models to improve accountability for the care 
furnished to Medicare beneficiaries. CMS believes that finding better approaches to reward 
quality care that results in improved health outcomes instead of quantity of services, while not 
increasing overall costs, remains an urgent priority. 

For physician payments, CMS is working to improve payment policy through CMS’ rulemaking 
process, including through the Medicare Physician Fee Schedule, while testing new payment 
models and delivery-system reforms that can help make physicians more accountable for the care 
they furnish, 

CMS has made important strides to improve the accuracy of our physician payment system and 
to support primary care. Through the misvalued code initiative, CMS has taken an active 
approach to evaluating potentially misvalued payment codes and, when codes are found to be 
misvalued, acting to update and revise the payment accordingly. The Agency has established a 
particular focus on those Physician Fee Schedule services that have not been reviewed recently 
and those where there is a potential for misuse. CMS has adopted appropriate work Relative 
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Value Units and direct Physician Expense inputs for these services as a result of these reviews 
and continues aggressively to identify potentially misvalued services. 

More broadly, CMS has begun testing several different payment models to help inform us as we 
begin to look for ways to improve Medicare payments in the long-term. We have outlined 
measurable goals and timelines to move the Medicare program toward paying providers ba.sed on 
the quality, rather than the quantity, of the services they provide. This is the first time in the 
history of the Medicare program that CMS has set explicit goals for alternative payment models 
and value-based payments. In alternative payment models, health care providers are accountable 
for the quality and cost of the care they deliver to patients. Providers have a financial incentive to 
coordinate care for their patients - which helps ensure patients receive the appropriate care for 
their conditions and reduces avoidable hospitalizations, emergency room visits, medication 
interactions, and other problems caused by gaps in care. 

In 2011, Medicare made almost no payments to providers through alternative payment models, 
but today such payments represent approximately 20 percent of Medicare payments. CMS 
intends to expand upon this progress, and has set a goal of lying 30 percent of traditional, fce- 
for-service Medicare payments to quality or value through alternative payment models, such as 
Accountable Care Organizations (ACOs) or bundled payment arrangements by the end of 2016, 
and tying 50 percent of payments to these models by the end of 2018. CMS has also set a goal of 
tying 85 percent of all traditional Medicare payments to quality or value by 2016 and 90 percent 
by 2018 through programs such as the Hospital Value Based Purchasing and the Hospital 
Readmissions Reductions Programs. 


CMS has already seen promising results on cost savings relating to alternative payment models, 
with current ACO programs saving Medicare a combined total of $417 million. CMS expects 
these models to continue contributing to the unprecedented slowdown in health care 
spending. Moreover, initiatives like the Partnership for Patients, ACOs, Quality Improvement 
Organizations, and others have helped reduce hospital readmissions in Medicare by nearly 
eight percent- translating into 150,000 fewer readmissions between January 2012 and 
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December 2013 - and quality improvements have resulted in saving 50,000 lives and $12 billion 
in health spending from 2010 to 2013, according to preliminary estimates.^ 

Enhancing Program Inteuritv 

CMS is committed to paying claims in an accurate and timely manner and has a comprehensive 
strategy in place to address the Medicare and Medicaid improper payment rates. For the 
Medicare program, these strategies include strengthening provider enrollment safeguards to 
confirm only legitimate providers are enrolled and preventing improper payments by using edits 
to deny claims that should not be paid. CMS also develops targeted demonstrations in areas with 
consistently high rates of improper payments and operates a Medicare fee-for-service Recovery 
Audit Program to identify, recover, and prevent improper payments. 

Strenethenine Provider Enrollment 

Provider enrollment is the gateway to billing within the Medicare program, and CMS has put 
critical safeguards in place to make sure that only legitimate providers are enrolling in the 
Medicare program. The Affordable Care Act required CMS to revalidate all of the 1.5 million 
existing Medicare suppliers and providers under new risk-based screening requirements. CMS is 
on track to request the revalidation of all providers by March 2015. Since March 25, 2011, more 
than one million providers and suppliers have been subject to the new screening requirements, 
over 454,000 provider and supplier practice locations had their billing privileges deactivated as a 
result of revalidation and other screening efforts, and almost 27,000 providers and suppliers had 
their enrollment revoked."' 

CMS continues to make improvements in its oversight of provider enrollment. For example, 
beginning September 2014, certain individuals required to complete enhanced screening as pari 
of the provider enrollment process must also undergo a fingerprint-based criminal history check. 
This policy applies to owners of newly enrolling home health agencies (HHAs) and durable 
medical equipment suppliers. In December 2014, CMS issued a Final Rule that permits 

’ hiHT/,'\v-ww.hhs.pov/n ews/Dress/2014pres/12/2014 1 2 02a.hirni 

■' Deaclivated providers could reactivate over time with updated practice information or after showing evidence ot 
proper licensing. 
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revocation of providers that demonstrate patterns or practices of abusive billing, prohibits the 
enrollment of providers that have unpaid debt to the Medicare program, and expands the list of 
felony convictions that could prevent an individual provider from participating in Medicare. 

CMS is using its moratorium authority provided in the Affordable Care Act to temporarily pause 
the enrollment of new Medicare, Medicaid, or CHIP providers and suppliers in certain 
geographic areas that face a high risk of fraud. In July 2013, CMS announced temporary 
moratoria on new HHAs in and around Miami and Chicago, and ground-based ambulances in 
and around Houston. In January 2014, CMS aimounced new temporary moratoria on the 
enrollment of HHAs in Fort Lauderdale, Detroit, Dallas, and Houston, and on ground 
ambulances in Philadelphia. CMS is required to re-evaluate the need for such moratoria every 
six months and on January 29, 2015, CMS extended these existing moratoria for an additional 
six months. In each moratorium area, CMS is taking administrative actions such as payment 
suspensions and revocations of billing privileges of HHAs and ambulance companies, as well as 
working with law enforcement to support investigations and prosecutions. 

Tareetine Hieh Risk Areas 

CMS has developed targeted demonstrations to reduce improper payments for items and services 
at high risk for fraud, waste, and abuse, such as Power Mobility Devices (PMDs), where CMS 
found that over 80 percent of claims for PMDs did not meet Medicare coverage 
requirements.'^ CMS implemented the Medicare Prior Authorization of PMDs Demonstration in 
seven high risk states in September 2012.* Since implementation, CMS has observed a decrease 
in expenditures for PMDs in both demonstration and non-demonstration states. Based on claims 
processed as of November 14, 2014, monthly expenditures for the PMDs included in the 
demonstration decreased from $20 million in September 2012 to $6 million in June 2014 in the 


'' htlp://cms.gov/Research-Statislics-Dala-and-Svslem!;/Monitorinp- 
Pr Qgrams/CERT/DownlQads/MedicareFFS2QllCERTReport-ndf 
'The seven states are: CA, IL. MI, NY, NC, FL and TX 
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nonnlemonstration states and from $12 million to $3 million in the demonstration states.’ CMS 
expanded the demonstration to an additional 12 states on October 1, 2014.® 

CMS is also testing whether prior authorization helps to reduce unnecessary expenditures, while 
maintaining or improving quality of care. CMS issued a proposed rule in May 2014 to establish 
a prior authorization process for certain durable medical equipment, prosthetics, orthotics, and 
supplies (DMEPOS) items that are frequently subject to unnecessary utilization. Additionally, 
CMS recently implemented a prior authorization model for repetitive scheduled non-emergent 
ambulance transport in New Jersey, Pennsylvania, and South Carolina.'* Beginning 
March 1, 2015, CMS will also begin implementing a prior authorization demonstration program 
for non-emergent hyperbaric oxygen therapy in Illinois, Michigan, and New Jersey.'® CMS 
believes using a prior authorization process will help ensure services are provided in compliance 
with applicable Medicare coverage, coding, and payment rules before services are rendered and 
claims are paid. 

While the private sector widely uses prior authorization to control fraud, waste and abuse, CMS 
is seeking authority to expand the use of this tool. The President's FY 2016 Budget includes a 
proposal that would build on the success of the prior authorization demonstrations by giving 
CMS the authority to require prior authorization for all Medicare fee-for-service items that it 
determines are at the highest risk for improper payments. 

Collaboration with the Private Sector 

CMS is engaging with the private sector in new ways to better share information to combat 
fraud. For example, the Healthcare Fraud Prevention Partnership (HFPP) has successfully 
shared information and built confidence and trust among partners since its inception in 

^lillps://%vww.c ms,gov/Rc s carch-Slalislics-Dala-ancl-Svslcms/Moniloring-Prograins/Mediciirc-FFS-Con TOliancc- 

ProgramS' Medicai-Review/Do\vnioads/FMDDemoDeccmberStatusuDdatel2.^02014.n df 

''http://www.gpo.gOV/fdsys/pkg/FR-2014-07-29/pdf/2014-17805.pdf; the twelve states are: AZ, GA, IN, KY, LA, 
MD, MO. NJ, OH, PA, TN, and WA 

” htlp ' « w cm s.t>ov/Research-Slatislic5-Data-3nd-Svstems/Monitoring-Proerams/Medicare-FFS-Compli ance- 
P'ilgi jms Prinr-Aiiihori73iion-lnilialives/Prior-Aulhorizalion-of-Renetilive-Scheduled-Noii-Emergeiil-Ambulance- 
[ ranspttrl-.html 

hiip://wvv w.cms.guv/Rese a ri:h-Slalislics-Dala-and-Svstems/Moniloring-Progranis/Mcdic a re-FFS-Co nipJiancc- 

l’roi-rams/Pri( tr-.Aulliorizalioii-lnitialivcs/ Frior- Autliorizaliun-of-Non-cmergcnl-Hvn erhari!;r0.xvRejLhliiil 
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July 2012. The partnership now includes 38 organizations. The number of state partners has 
grown, with the state program integrity or oversight offices of Illinois, Massachusetts, Texas, 
Vermont and California joining along with private payers. We are continuing to grow 
strategically by adding new partners and identifying additional overlapping fraud schemes. The 
HFPP has completed the following four studies to date - Misused Codes and Fraud Schemes, 
Non-Operational Providers (or "false store fronts"). Revoked and Terminated Providers, and 
Top-Billing and High Risk Pharmacies - that have enabled partners, including CMS, to take 
substantive actions to stop payments from going out the door. The HFPP is now in the process 
of launching three new studies based on successful identification of continuing challenges faced 
by current and new members. 

The President’s FY 2016 Budget proposal includes additional support for the HFPP 
collaboration. The proposal would give CMS the authority to accept gifts made to the Trust 
Funds for particular activities funded through the Health Care Fraud and Abuse Control Account, 
including the HFPP. Currently, the account can only receive gifts that are made for an 
unspecified purpose. This proposal would allow for gifts to be made to support the HFPP 
directly, and allow both public and private partners to support the anti-fraud program. 

Improving Program Management 

Building on its expert knowledge from investigators and analysts, CMS is leading the 
government and healthcare industry in systematically applying advanced analytics to claims on a 
nationwide scale. Since 2011, CMS has been using its Fraud Prevention System (FPS) to apply 
advanced analytics on all Medicate fee-for-service claims on a streaming, national basis by using 
predictive algorithms and other sophisticated analytics to analyze every Medicare fee-for-service 
claim against billing patterns. The system also incorporates other data sources, including 
information on compromised Medicare cards and complaints made through 1-800- 
MEDICARE. When FPS models identify egregious, suspect, or aberrant activity, the system 
automatically generates and prioritizes leads for review and investigation by CMS’ Zone 
Program Integrity Contractors (ZPICs). The ZPICs then identify administrative actions that can 
be implemented swiftly, such as revocation, payment suspension, or prepayment review, as 
appropriate. The FPS is also an important management tool, as it prioritizes leads for ZPICs in 
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their designated region, making our program integrity strategy more data-driven. To better 
protect seniors and the Medicare program against compromised Medicare cards," 

President’s FY 2016 Budget proposes $50 million to support the removal of Social Security 
Numbers from Medicare cards so that millions of beneficiaries will no longer have to fear that 
their personal identification numbers could be used against them due to a lost, stolen, or misused 
Medicare card. 

In its second year of operation, CMS’ FPS identified or prevented more than $210 million in 
improper Medicare fee-for-service payments, double the previous year. It also resulted in CMS 
taking action against 938 providers and suppliers. The FPS is a key element of the joint anti- 
fraud strategy between the Department of Justice (DOJ) and HHS that has led to a record 
$19.2 billion in recoveries between 2009 and 2013, up from $9,4 billion over the prior five-year 
period. Importantly, these joint efforts have also led to a measurable decrease in expenditures in 
areas of focus. For example, there has been a dramatic decline in pa^ inent for home health care 
in Miami and throughout Florida. In 2009, claims to Medicare for home health services in 
Florida were $3.4 billion, and Medicare paid approximately $2.9 billion for home health care 
services. Just two years later, in 2011, billings to Medicare had dropped to $2.3 billion, a 
difference of $1.1 billion. 

The President’ s FY 20 1 6 Budget proposes to build on recent progress demonstrated by joint 
efforts between DOJ and HHS by increasing support for the Health Care Fraud and Abuse 
Control program. Billions of dollars in deficit savings over the next 10 years from curtailing 
improper payments will be realized if the levels of administrative expenses for program integrity 
envisioned in the Balanced Budget and Emergency Deficit Control Act of 1985 continue to be 
provided. 


' ' MEDICARE INFORMATION TECHNOLOGY: Centers for Medicare and Medicaid Services Needs to Pursue a 
Solution for Removing Social Security Numbers from Cards. GAO-13-761: Published: Sep 10, 2013. Publicly 
Released: Ocl 17, 2013. 
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Medical Review 

Medicare receives about 3.3 million fee-for-service claims each day, or 1.2 billion claims a 
year. In keeping with statutory requirements to promptly pay claims, our processing systems 
were built to quickly process claims and remit payment. Due to the significant cost associated 
with conducting a medical review of an individual claim, CMS relies heavily on automated edits 
to identify inappropriate claims. CMS has designed its systems to detect anomalies on the face 
of the claims, and through these efforts, we are correctly paying submitted claims nearly 
100 percent of the time. For example, CMS is using the National Correct Coding 
Initiative (NCCI) to stop claims that never should be paid in Medicare Part B and 
Medicaid. This program prevents payments for services such as hysterectomy for a man or 
prostate exam for a woman. The use of the NCCI procedure-to-procedure edits saved the 
Medicare program $530 million in FY 2013. 

The Recovery Audit Program identifies areas for potential improper payments and offers an 
opportunity to provide feedback to providers on future improper payment prevention. CMS uses 
Recovery Auditors, as required by law,'^ to identify and correct improper payments by reviewing 
claims on a post payment basis. CMS responds to the vulnerabilities identified by the Recovery 
Auditors by implementing actions that will prevent future improper payments nationwide. Since 
full implementation in FY 2010 through the fourth quarter of FY 2013, the Recovery Auditors 
have returned over $5.4 billion to the Medicare Trust Fund. Additionally, CMS Medicare 
Administrative Contractors (MACs) review claims and conduct provider education to help 
providers avoid documentation errors and other sources of improper payments, including articles 
or bulletins providing narrative descriptions of the claim errors identified and suggestions for 
their prevention. Other efforts include system edits for improper payments that can be 
automatically prevented prior to payment. CMS encourages collaboration between Recovery 
Auditors and MACs to discuss improvements, areas for possible review, and corrective actions 
that could prevent improper payments. 


The Recovery Auditor demonstration project was required by section 306 of the Medicare Prescription Drug, 
Improvement, and Modernization Act of 2003, and the Congress expanded the program in section 302 of the Tax 
Relief and Health Care Act of 2006, directing CMS to implement a permanent national recovery audit contractor 
program by January 1, 2010. 
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CMS strives to manage programs in an efficient manner that balances the need to limit burden on 
Medicare providers with our responsibility to protect Trust Fund dollars. CMS has carefully 
evaluated the Recovery Audit program, and announced a number of changes to it in response to 
industry feedback.*'^ CMS is confident that these changes will result in a more effective and 
efficient program through enhanced oversight, reduced provider burden, and more program 
transparency. These changes will be effective with each new contract award beginning with the 
Durable Medical Equipment, Home Health and Hospice Recovery Audit contract awarded on 
December 30, 2014.*'' The President’s FY 2016 Budget also includes a proposal to permit CMS 
to retain a portion of recovered funds to implement corrective actions identified through the 
Recovery Audit program. 

Improving Part D Oversight 

CMS also continues to refine our Medicare Part D program integrity efforts and enhance our 
oversight of the Medicare Drug Integrity Contractor (MEDIC), which is charged with identifying 
and investigating potential fraud and abuse, and developing cases for referral to law enforcement 
agencies. The MEDIC has implemented a new proactive data analysis effort to identify potential 
program vulnerabilities, which has a resulted in the recovery of $51 million in improper 
payments from one study alone. CMS issued a final rule that established a new revocation 
authority for abusive prescribing patterns that requires prescribers of Part D drugs to enroll in 
Medicare or have a valid opt-out affidavit on file by December 2015. Additionally, CMS may 
now also revoke a prescriber’s Medicare enrollment if his or her Drug Enforcement 
Administration (DEA) Certificate of Registration is suspended or revoked, or the applicable 
licensing or administrative body for any State in which a physician or eligible professional 
practices has suspended or revoked the physician or eligible professional’s ability to prescribe 
drugs.'*’ 


" Sec hiip ./w ww enis.gov/Research-Statistics-Dala-and-Svslems/Monitor ing-Progranis/Meclicare-FFS- 
C onuilia n ii-Pmprams/Rccoverv-Audil-Program/Downloads/RAC-PrQgram-lmp r ovcm . ents j)d|. 

” Due !o a post-award protest filed at the Government Accountability Office (GAO), CMS has delayed the 
commencement of work under the national DMEPOS/HH&H, Region 5, Recovery Audit contract. 

” hitp-/.'oi p.hhs.f>ov/oei/rcporls/oei-02-09 -00608.pdf 


11 



103 


The President’s FY 2016 Budget includes a proposal to give the Secretary the authority to 
establish a requirement that high-risk Medicare beneficiaries only use certain prescribers and/or 
pharmacies to obtain controlled substance prescriptions, similar to many state Medicaid 
programs. Currently, CMS requires Part D sponsors to conduct drug utilization reviews, which 
assess the prescriptions filled by a particular enrollee. These efforts can identify overutilizalion 
that results from inappropriate or even illegal activity by an enrollee, prescriber, or 
pharmacy. However, CMS’ statutory authorities to take preventive measures in response to this 
information presently are limited. Under the President’s FY 2016 Budget proposal, the Medicare 
program would still be required to ensure that beneficiaries retain reasonable access to services 
of adequate quality. 

Improving Oversight of Medicaid’s Fiscal and Program Integrity 

Medicaid consists of 56 distinct programs, one in each U.S. state and territory, covering acute 
health care, long-term care, and other services for millions of low-income Americans. CMS is 
responsible for overseeing the program at the Federal level, while states administer their 
respective programs’ day-to-day operations. This federal-state partnership is central to the 
success of the Medicaid program, but it depends on clear lines of responsibility and shared 
expectations. CMS takes seriously our role in overseeing the financing of Medicaid programs, 
and we continue to look for ways to refine and further improve our processes. 

CMS has undertaken several initiatives over the last several years that build upon our existing 
programs and tools, such as improving data analytic capacity and overseeing non-federal share 
funding. CMS’ Medicaid Integrity Program provides the assistance of Federal staff specializing 
in program integrity and contractor support to bolster state activities. Based on states’ quarterly 
reports to HHS, this assistance supported state efforts to collect $944.4 million in total 
collections in FY 2014. The President’s FY 2016 Budget also includes a number of Medicaid 
program integrity proposals that strengthen HHS’s and the states’ ability to fight fraud, wa.ste 
and abu.se in the Medicaid program. 


Additionally, CMS has worked with states to improve Medicaid and CHIP data and data analytic 
capacity through the Medicaid and CHIP Business Information Solutions (MACBIS) 
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initiative. This initiative includes changes to the Medicaid Statistical Information 
System (MSIS), which will be known as Transformed-MSIS or T-MSIS. The enhanced data 
available from T-MSIS v/ili support improved program and financial management and enhance 
the ability to identify potential fraud. T-MSIS will not only allow CMS to acquire higher quality 
data, but it will also reduce state data requests. States will move from MSIS to T-MSIS on a 
rolling basis with the goal of having all .states submitting data in the T-MSIS file format in 2015. 

As capitated managed care arrangements have become a commonly used approach to Medicaid 
service delivery and are expected to grow in the coming years as new beneficiaries enroll, CMS 
has increased our oversight of the process used to ensure that rates set are actuarially sound. For 
the 2014 contract year, CMS, in collaboration with CMS’ Office of the Actuary (OACT), issued 
a rate-setting consultation guide; held in-depth consultation meetings with states and their 
consulting actuaries to discuss that guidance; and identified key elements that should be 
described in the filed rate methodologies. As a result, CMS updated and further refined the rate- 
setting guidance for the 2015 contract year. We continue to work closely with states during this 
review process in order to make certain they meet all requirements, and are committed to 
improving our oversight across all capitated contracting arrangements through new initiatives 
that increase transparency. 

Moving Forward 

CMS is dedicated to making historic strides toward the goals of promoting better care, protecting 
patient safety, reducing health care costs, and allowing beneficiaries to get the right care when 
they need it. The past several years have brought numerous impressive gains in these areas, but 
more work remains. Strengthening and improving upon programs that provide vital services to 
millions of Americans, such as Medicare and Medicaid, is a continuous process, and at CMS we 
take seriously our responsibilities to taxpayers and beneficiaries. We will continue to work with 
stakeholders to establish new initiatives and expand upon our existing programs to fight fraud, 
reduce improper payments, examine alternative payment methods, and improve oversight. We 
look forward to working with this Committee to further improve Medicare and Medicaid. 
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Chairman Chaffetz. Mr. Lightfoot, you are recognized for 5 
minutes. 


STATEMENT OF ROBERT LIGHTFOOT 

Mr. Lightfoot. Thank you, Chairman Chaffetz, Ranking Mem- 
ber Cummings, other members of the committee. Appreciate the 
opportunity to appear today to discuss NASA’s efforts to improve 
acquisition management. NASA develops missions and capabilities 
to expand the frontiers of knowledge, capability and opportunities 
in space and here on Earth. By the very nature of our mission, 
NASA’s activities are inherently high risk. At the same time, we 
recognize the critical importance of managing our projects as effec- 
tive stewards of taxpayers’ dollars. This means managing our 
projects to deliver them on cost, on schedule, and identifying risks 
as quickly as possible so we can implement appropriate corrective 
action. 

We’ve made significant improvements both in managing our 
projects and preparing our managers. These improvements are al- 
ready yielding results, particularly with our small and medium 
class missions. We have seen a significant reduction in the number 
of projects that exceed their baselines, and, in fact, several projects 
have recently launched within their baselines, including Juno, 
Landsat 8, the Mars Atmosphere and Volatile Evolution, and just 
2 weeks ago, the Soil Moisture Active Passive Mission, or SMAP. 

Our larger, more complex projects typically involve technical — 
typically involve the development of significant number of new 
technologies, which present greater technical risk, but even the 
James Webb Space Telescope, the next great observatory in space, 
which was originally confirmed on an old cost policy that we used 
and had exceeded its original baseline, has benefited from our im- 
proved process. The James Webb Space Telescope has remained on 
track to meet the new cost and schedule baseline we established 
in accordance with the new policy 3 years ago. 

NASA cost policies have evolved over time toward a probabilistic 
joint cost and schedule confidence level analysis. This joint con- 
fidence level analysis enables NASA to estimate the probability of 
completing a project within a certain life cycle cost and schedule 
based on the individual project’s unique technical and pro- 
grammatic characteristics. A key benefit to the joint confidence 
level policy is the added rigor it brings to the analysis process, 
driving an integrated analysis of the cost schedule and technical 
risk. 

NASA has also taken steps to enhance the agency’s earned value 
management capabilities. Earned value management guidance is 
provided to the NASA community through the recently released 
project management handbook, as well as through the EBM hand- 
book. NASA routinely reviews earned value management data at 
formal regular recurring meetings at the projects at the center, at 
the mission, and at the agency level, as well as in ad hoc meetings 
should issues arrive. NASA relies on the knowledge we gain with 
each new project in order to improve our project management prac- 
tices, and introduces new tools to assess whether our projects are 
on track to meet their cost and schedule commitments. 



107 


I would like to thank the GAO for their hard work and their val- 
uable insights. We appreciate the open dialog we’ve had with them 
over the last few years, as we’ve both improved — as we’ve worked 
to improve and refine our project management capabilities. As a re- 
sult, I think what — and while I think there’s still a lot of work to 
be done, I am confident that we are on the right track to improving 
project management at NASA. 

Thank you for the opportunity to be here, and I look forward to 
your questions. 

[Prepared Statement of Robert Lightfoot follows:] 
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Mr. Chairman and Members of the Committee, thank you for the opportunity to appear 
today to discuss NASA’s efforts to improve acquisition management in response to the 
Government Accountability Office’s (GAO’s) 2015 High Risk List. By the very nature 
of our mission and the work we do. NASA’s activities are inherently “high risk” 
endeavors, as we are constantly looking to expand the frontiers of human knowledge. 
There is no other agency in the Nation, let alone the world, undertaking as ambitious a 
program of exploration and technology development as NASA. As we develop the 
unique missions and capabilities to explore space, and advance understanding of Earth 
and develop technologies to improve the quality of life on our home planet, we also 
recognize the need to be responsible stewards of taxpayers’ dollars. This means 
delivering missions on cost and on schedule and identifying risks as quickly as possible 
so we can implement appropriate corrective action. 

When NASA was first added to the GAO’s High Risk List in 1990, our project 
management and oversight practices did not have the same level of rigor as they do 
today, leading to cost overruns and schedule delays. Since then, we have made 
significant improvements to how we manage projects and prepare people to manage, 
leading to a dramatic reduction in the number of projects that exceed their baselines. 
Several projects have recently launched within their baselines, including Juno, Landsat 
Data Continuity Mission (LDCM)/Landsat 8, Mars Atmosphere and Volatile EvolutioN 
(MAVEN), and just two weeks ago. Soil Moisture Active Passive (SMAP). Moreover, 
other projects still in development are on track to be completed within their baselines, 
such as Origins-Spectral Interpretation-Resource Identification-Security-Regolith 
Explorer (OSIRIS-REx). Even the James Webb Space Telescope (JWST), which was 
originally confirmed under an old cost policy and exceeded its original baseline, has 
benefited from these changes and has remained on track to meet its new cost and 
schedule baseline, which was set in accordance with the new policy. In the instances 
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where a project confirmed in accordance with the new policy does experience issues, the 
percentage of growth relative to the total project cost has greatly diminished as well. 

This is a trend that the GAO has observed over the past several years in their atmual 
“Assessments of Selected Large-Scale Projects.” 

The 2015 High Risk Report includes a scorecard detailing which of the GAO’s five 
criteria for removal from the High Risk List have been met, partially met, or are unmet 
for each High Risk area. I am pleased to report that NASA has fully met the leadership 
commitment, action plan, and monitoring criteria. The remaining two criteria, capacity 
and demonstrated progress, have been partially met and we are actively working to 
implement additional changes across the Agency to address them. 

Corrective Action Plan 

NASA has been working to implement seven initiatives to improve acquisition 
management through a High Risk Corrective Action Plan developed in 2007. Those 
initiatives are; (1) Program/Project Requirements and Implementation Practices; (2) 
Agency Strategic Acquisition Approach; (3) Contractor Cost Performance Monitoring; 
(4) Project Management Training and Development; (5) Improve Life-Cycle 
Cost/Schedule Management Processes; (6) Integrated Enterprise Management Program 
(lEMP) Process Improvement; and, (7) Procurement Processes and Policies. Six of these 
seven initiatives are operational, as NASA has put in place new requirements, policies, 
procedures, training, and other tools to improve how we manage our major acquisitions 
and ensure our workforce has the necessary associated tools. Even though these 
initiatives are operational, we continually look for new ways to refine how we do 
business and share best practices and lessons learned within the project management 
community. 

In 2014, NASA declared that the one outstanding initiative. Contractor Cost Performance 
Monitoring, was closed. This initiative was originally designed to improve the 
availability of contractor data to support performance monitoring of programs and 
projects. The initiative would be accomplished through the use of enhanced business 
systems and changes to the contractor cost reporting process. NASA performed analyses 
at that time to identify gaps in the existing key business systems and concepts and 
courses of action that could be implemented to address those gaps. As a result of this 
analysis, NASA and GAO agreed to replace the original objective, and instead instituted 
several process improvements designed to achieve greater insight into project 
performance, including contractor cost performance. Among these improvements is 
expanding the number of projects subject to earned value management (EVM) 
requirements by lowering the lifecycle cost threshold. 

As part of the Corrective Action Plan, in 2008, NASA established a set of metrics to 
assess performance on a semi-annual basis. These metrics consider performance against 
the established cost and schedule baselines and annual performance indicators, as well as 
whether new projects are being implemented in accordance with NASA policy. As of the 
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most recent performance report provided to the GAO, based on NASA’s performance as 
of the fourth quarter of 2014, NASA is folly on track to meet all of these metrics. 

We are in the process of reassessing these metrics to ensure that they continue to be folly 
aligned with NASA requirements and will work with the GAO as necessary to update 
how they are calculated. For example, to coincide with the release of the 2014 NASA 
Strategic Plan, we updated the suite of Aimual Performance Indicators (APIs) evaluated 
as a measure of whether NASA’s major projects were on track to meet their level 1 
requirements. This list of assessed APIs was expanded to include all major projects in 
the portfolio. We will undertake a similar review following the release of subsequent 
strategic plans. 

2015 High Risk List Response 

GAO has identified five criteria that must be met before a focus area can be removed 
from the High Risk List; (1 ) a demonstrated strong commitment to, and top leadership 
support for, addressing problems; (2) the capacity to address problems; (3) a corrective 
action plan; (4) a program to monitor corrective measures; and, (5) demonstrated 
progress in implementing corrective measures. 

NASA has fully met the leadership commitment, action plan, and monitoring criteria, and 
has partially met the criteria for capacity and demonstrated progress, hi order to meet the 
remaining criteria, the GAO would like NASA to address gaps in the guidance for the 
joint cost and schedule confidence level (JCL) policy and EVM, as well as demonstrate 
continuing success in keeping projects within their cost and schedule baselines 
established at confirmation. These are all areas where NASA is devoting significant 
resources to improve our capabilities, leading to better management of our projects. 

NASA cost policies have evolved over time towards a probabilistic JCL analysis that 
enables decisions to be made on desired confidence levels (the probability of completing 
a project within a certain lifecycle cost and schedule) based on an individual project’s 
unique technical and programmatic characteristics. A key benefit of the JCL policy is the 
added rigor it brings to the analysis process, driving an integrated analysis of cost, 
schedule, and risk. From the project manager’s perspective, the JCL helps them to better 
understand and manage their risks. From a decision maker’s perspective, the JCL helps 
them understand the risks inherent in a project so they are able to make folly informed 
decisions as to what level of risk is acceptable to the Agency. 

NASA first established its JCL policy in 2009 by requiring a JCL of major projects 
coming to confirmation. This requirement was subsequently expanded to include cost 
and schedule ranges for projects going through Key Decision Points during the 
Formulation Phase. Since the JCL policy was put into place, programmatic performance 
has improved as NASA has launched more projects at or nearer their original cost and 
schedule baselines than under previous policies. NASA acknowledges there is still room 
for improvement with the JCL implementation, as evidenced by two recent examples of 
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projects breaching their baselines shortly after confirmation. However, many more 
projects have been able to keep to their commitments. 

NASA’s approach to conducting JCLs has evolved as we have gained more experience 
with them, and there are several improvements in work to further enhance our 
capabilities. For example, NASA expects to release an updated version of our Cost 
Estimating Handbook later this month, which will provide additional guidance on how to 
conduct JCLs. JCLs can be very complex, so NASA is developing new tools to better 
communicate risk, such as graphical and tabular reports, as well as new techniques and 
tools to enable more accurate assessments of complex JCL models. In addition, NASA is 
proactively identifying areas of improvement and developing solutions to strengthen the 
community of practice through education, training, data sharing and communication. 

As with improvements to JCLs, NASA is taking a similar approach to enhancing the 
Agency’s EVM capabilities. EVM guidance is provided to the NASA community 
through the recently released Project Management Handbook, as well as through the 
EVM Handbook. This past year, we also developed an Integrated Program Management 
Report Instructions Guide to provide a methodology for evaluating cost and schedule 
data. We are planning to issue a draft NASA Project Planning and Control (PP&C) 
handbook, which would establish PP&C standards across the Agency, later this year for 
review. 

Since 2013, NASA has been rolling out an in-house EVM capability at the major 
spaceflight centers. To date, this capability has been implemented on Space Launch 
System (SLS; Marshall Space Flight Center), Ice, Cloud, and Land Elevation Satellite-2 
(ICESat-2; Goddard Space Flight Center), and Groimd Systems Development Office 
(GSDO; Keimedy Space Center). In 201 5, the capability will be implemented on Orion 
(Johnson Space Center). We are also working with several of our contractors to validate 
their EVM systems, including the Applied Physics Lab and the Southwest Research 
Institute, as well as engaging with universities and other research organizations that may 
lead NASA projects but do not otherwise have institutional requirements for fully- 
developed EVM systems. 

Another area of focus has been developing and issuing guidance for smaller projects. 

This past September, NASA formalized the EVM requirements for space flight projects 
with lifecycle costs under $150 million. These requirements provide clear guidelines and 
expectations for how EVM will be implemented, including opportunities for tailoring 
their EVM in such a way as to reduce unnecessary burden given the limited resources 
provided to these projects. To aid in this effort, NASA is currently developing an EVM 
scalability solution that will benefit smaller missions. 

NASA has many forums where this data is routinely reviewed to ensure that projects 
remain on track or that issues are identified and resolved in a timely manner. This 
includes formal, regularly recurring reviews at the project. Center, Mission Directorate, 
and Agency level, as well as ad hoc meetings should issues arise. We also are improving 
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our communities of practice to share best practices and lessons learned across 
organizations so projects can learn from each other. 

The Path Forward 

As NASA seeks to undertake a bold new era of discovery, we are also developing one-of- 
a-kind technologies and capabilities. We therefore rely on the iterative knowledge we 
gain with each new project in order to improve our project management practices and 
introduce new tools to assess whether our projects are on track to meet their cost and 
schedule commitments. We appreciate the open dialog we have had over the past several 
years with the GAO as we have refined our project management requirements and 
discussed best practices that might apply to our projects at different stages in their 
lifecycles. As the GAO has acknowledged, these improvements are already yielding the 
desired results with our small and medium-class missions. Our larger, more complex 
projects typically involve the development of a significant number of new technologies, 
which present greater risk and are more difficult to assess at the outset. As a result, while 
there is still work to be done, 1 am confident we are on the right track and we ■will 
continue to manage projects without the significant cost growth and schedule delays that 
originally put us on the High Risk List. 
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Robert M. Lightfoot, Jr., Associate Administrator 

Robert M. Lightfoot Jr. became Associate Administrator for NASA, the agency's highest-ranking civil servant position, 
effective Sept. 25, 2012. 

He previously was director of NASA’s Marshall Space Flight Center in Huntsville, Ala. Named to the position In 
August 2009, he headed one of NASA's largest field installations, which plays a critical role in NASA’s space 
operations, exploration and science missions. Lightfoot managed a broad range of propulsion, scientific and space 
transportation activities contributing to the nation's space program. He served as acting director of the center from 
March 2009 until his appointment as director. 

From 2007 to 2009, Lightfoot was deputy director of the Marshall Center. Lightfoot served as manager of the Space 
Shuttle Propulsion Office at Marshall from 2005 to 2007, where he was responsible for overseeing the manufacture, 
assembly and operation of the primary shuttle propulsion elements; the main engines, external tank, solid rocket 
boosters and reusable solid rocket motors. 

From 2003 to 2005, he served as assistant associate administrator for the Space Shuttle Program in the Office of 
Space Operations at NASA Headquarters in Washington. His responsibilities Included space shuttle return to flight 
activities following the Columbia tragedy, technical and budgetary oversight of the $3 billion annual budget and initial 
transition and retirement efforts for shuttle infrastructure. 

In 2002, Lightfoot was named director of the Propulsion Test Directorate at NASA's Stennis Space Center. He served 
as deputy director of the organization beginning in 2001 , until his appointment as director. 

Lightfoot began his NASA career at the Marshall Center in 1989 as a test engineer and program manager for the 
space shuttle main engine technology test bed program and the Russian RD-180 engine testing program for the Atlas 
launch vehicle program. 

Lightfoot received a bachelor's degree in mechanical engineering in 1986 from the University of Alabama. In October 
2007, he was named Distinguished Departmental Fellow for the University of Alabama, Department of Mechanical 
Engineering. He was selected as a University of Alabama College of Engineering fellow in 2009. Lightfoot serves on 
the University of Alabama Mechanical Engineering Advisory Board, in 2010, he was inducted into the State of 
Alabama Engineering Hail of Fame. 

Lightfoot has received numerous awards during his NASA career, including a NASA Outstanding Leadership medal 
in 2007 for exemplary leadership of the Shuttle Propulsion Office, assuring safety for the return to flight of the space 
shuttle. In 2006, he was awarded the Presidential Rank Award for Meritorious Executives, and in 2010 he received 
the Presidential Rank Award for Distinguished Executives — the highest honors attainable for federal government 
work. In 2000, Mr. Lightfoot received a Spaceflight Leadership Recognition Award, \Miich recognizes leaders who 
exemplify characteristics necessary for success. In 1999, NASA's astronaut corps presented him with a Silver 
Snoopy Award, which honors individuals who have made key contributions to the success of human spaceflight 
missions. He also received the NASA Exceptional Achievement Medal in 1996 for significant contributions to NASA's 
mission. 
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Chairman Chaffetz. I thank the gentlemen. With the vote on 
the floor, the committee will stand in recess. When votes conclude, 
we will continue, and we thank you again all for your patience. 

[Recess.] 

Chairman Chaffetz. Committee will come to order. I thank you 
all for your patience with votes on the floor. We obviously got de- 
layed. 

I’d actually like to start by recognizing the gentleman from North 
Carolina, who’s the chairman of one of our subcommittees on gov- 
ernment — the Subcommittee on Government Operations. The gen- 
tleman from North Carolina, Mr. Meadows, for 5 minutes. 

Mr. Meadows. Thank you, Mr. Chairman. And thank each of you 
for being incredibly flexible today. 

Really, I guess the underlying concern that I have is as we 
have — are celebrating the 25th anniversary, is we’ve got to figure 
out a way to get off of the high-risk list. It’s not a very high bench- 
mark. You know, really if you look at the components of that, it 
is just making a real concerted effort. And so I’m looking forward 
to each one of you putting together a plan to make sure that we 
can do that. 

Doctor, let me come to you. I sent you a text, and I want to com- 
pliment you — I actually sent you an email. I want to compliment 
you on the fact that on a weekend, you responded via email, which 
was shockingly surprisingly — surprising, and I want to just say 
thank you. 

Do you have the automatic re-enrollment numbers that I’ve been 
requesting from CMS? Have they given those to you? 

Dr. Agrawal. Yes. Mr. Meadows, thanks for the question and 
I’m happy to be accessible whenever you need. So the answer is I 
think we’re still working on it. You know, that is part of the agency 
obviously that I don’t have direct oversight over. My understanding 
is that you’ve had numerous conversations with the CEO of the 
marketplace, Kevin Counihan, and that they are working on as- 
sembling those numbers. I think obviously, as you know, our focus 
is certainly on getting the numbers out to you and the public, but 
making sure that they are accurate when we do. 

Mr. Meadows. All right. So what you are saying is that you have 
not seen the numbers for the automatic re-enrollment. You’ve 
never seen any totals? 

Dr. Agrawal. I have not, correct. 

Mr. Meadows. OK. It’s my understanding that we have those 
numbers, and we’ve been trying for 60 days to get it. Any reason 
why it would take that long to verify numbers? 

Dr. Agrawal. I think it’s just confirming that the numbers are 
numbers we can stand behind, making sure that they’re good num- 
bers that ought to be released. Again, I believe staff at CMS are 
in touch with your staff, and obviously, you’ve been in touch 
with 

Mr. Meadows. Well, they — we’ve been in touch. They have not 
really been in touch 

Dr. Agrawal. Gotcha. 

Mr. Meadows [continuing]. From a followup. It’s amazing to me 
that we can have the response time for those that get recorded 
messages or wait times for Spanish-speaking operators, and we 
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know that down to the second, or actually tenth of a second, and 
yet we can’t get automatic re-enrollment numbers from CMS. 
When can we expect those? 

Dr. Agrawal. I don’t have a particular timeline. 

Mr. Meadows. All right. Well, let me go on further, because I’ve 
got limited time. Let’s look at Medicare. You’re going from 14,000 
lines of code to 68,000 codes in terms of Medicare reimbursement. 
Is that correct? 

Dr. Agrawal. Are you talking about ICD-10? 

Mr. Meadows. Yes. ICD-9, 10. ICD-10. 

Dr. Agrawal. Sure. 

Mr. Meadows. So we’re going to different codes. 

Dr. Agrawal. Yes. 

Mr. Meadows. And so doctors and hospitals putting in the wrong 
code will come out as an improper payment or fraud. Is that cor- 
rect? 

Dr. Agrawal. Not necessarily. So it really 

Mr. Meadows. Or improper payment? 

Dr. Agrawal. It may. You know, obviously the importance of 

Mr. Meadows. Why would we go from 14,000 codes to 68,000 
codes? How could that make it more efficient? 

Dr. Agrawal. Well, first let me say the agency is adopting these 
codes that are actually established outside of agency processes and 
with the input of the provider community. In fact, it was really the 
provider community searching for specificity and the ability to real- 
ly define exactly what they were seeing in the 

Mr. Meadows. So they were getting the payments they wanted? 

Dr. Agrawal. So they could get appropriately reimbursed. 

Mr. Meadows. Let me ask you. I mean, I went through and 
looked at your codes. We’ve got codes now that one in particular 
says if you unexpectedly are missing your big toe. Unexpectedly 
missing a big toe gets a code. There are six different codes for 
squirrels, I mean, so if a squirrel bites you, if it’s the first time or 
second time, if it scratches you. Do you not see that we’ve got unbe- 
lievable lines of code, that more codes will not make it more effi- 
cient? There’s one code in here for spending too much time in a 
freezer. I mean, it’s incredibly ridiculous. And let me tell you, the 
physicians that I talk to and the hospitals I talk to are spending 
millions of dollars in compliance trying to figure out your codes, 
and yet we’re going to increase those by four-fold? Why would you 
do that? 

Dr. Agrawal. Well, again. I’d be just careful. And let me just 
say, I believe there’s a code for an Orca attack as well. 

Mr. Meadows. There — there is. 

Dr. Agrawal. There are numerous different kinds of codes. I 
don’t imagine in my own practice to be using that one or many of 
the others. However 

Mr. Meadows. Well, let me ask you 

Dr. Agrawal [continuing]. I would like to say 

Mr. Meadows [continuing]. Is a mouse a rodent? 

Dr. Agrawal. Pardon me? 

Mr. Meadows. Is a mouse a rodent? 

Dr. Agrawal. I assume it is. 



116 


Mr. Meadows. Well, but you’ve got a different code for a rodent 
than a mouse, and, I mean — what I’m saying is it’s so complicated, 
you make it so complicated, that nobody can comply. 

Dr. Agrawal. I think to be clear, though, the agency is a recipi- 
ent of ICD-10, just as other agencies are. We did not intend 

Mr. Meadows. But you’re in control of that, are you not, on im- 
plementing that, your Program Integrity? 

Dr. Agrawal. No. There are actually numerous parts of the 
agency. I mean, we are actually required to implement ICD-10. I 
realize that Congress has delayed implementation of that require- 
ment, but at some point we are required to implement ICD-10, and 
that’s meant to — you know, the code design itself is not something 
that CMS is engaged in. It is really designed to improve both epi- 
demiologic understanding of administrative data to make sure ad- 
ministrative data really reflects what’s going on in the real world 
clinically, and that providers have had extensive input into these 
code sets. 

I don’t necessarily disagree with your point, but I think we are 
as much a recipient of ICD-10 as other agencies that are imple- 
menting it across the world. 

Mr. Meadows. Well, my time’s expired. I’ll yield back, Mr. Chair- 
man. 

Chairman Chaffetz. Thank the gentleman. Recognize the rank- 
ing member, Mr. Cummings, for 5 minutes. 

Mr. Cummings. Yes. Dr. Agrawal, I want to thank you for ap- 
pearing before our committee today. CMS has undertaken a num- 
ber of initiatives to reduce fraud and improper payments in the 
Medicare program. I just — I’m just concerned about how they work 
and how effective they are and what you see for the future. I’d like 
to ask you about these today. The ACA requires increased scrutiny 
of providers and suppliers who have historically posed a higher risk 
of fraud or abuse. This heightened screening process applies to pro- 
viders and suppliers that are attempting to either newly enroll in 
the Medicare program or re-validate their participation. 

Can you describe the different risk-based screening level designa- 
tions and the various requirements that providers and suppliers in 
each category are subject to? 

Dr. Agrawal. Sure. So provider categories by provider type es- 
sentially are subdivided among three risk categories: Limited, me- 
dium and high. And as you go up the chain of risk, more screening 
strategies and approaches are implemented to screen those types 
of providers, again, whether they’re newly enrolling or revalidating. 
At the highest level of risk, say, a newly enrolling DME company 
or home health agency, there are automated background checks 
that would be performed that really are performed for all provider 
types to ensure adequate licensure, lack of a criminal — relevant 
criminal background or felony record that would keep a provider 
out of the program. But in addition, high risk — the highest risk 
providers face site visits, they face fingerprint-based background 
checks. So a multitude of different screening approaches for the 
highest risk providers, and that also includes providers who are at- 
tempting to re-enroll after having a Program Integrity action taken 
against them in the past. 
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The result of all of this work, and to — ^you know, to date, we have 
revalidated over a million of the million and a half providers and 
suppliers enrolled in Medicare, and the totality of all this work on 
both newly enrolling and revalidation is that we have removed the 
billing privileges of over 450,000 enrollments in Medicare to date. 
And I can tell you that these new enrollment requirements are also 
allowing us to deny more applications at the front end, so providers 
actually never make it into the program because they do not qual- 
ify- 

Mr. Cummings. Well, that’s what I was about to ask you. So as 
opposed to chasing money, you do some preventive things. Is that 
right? 

Dr. Agrawal. I think a lot of our provider enrollment work real- 
ly solidly lands in the preventive category, because it really is de- 
signed to keep folks out of the program that don’t — that don’t be- 
long. So if we conduct a site visit and determine that you are a 
non-operational provider, then you never make it into the program, 
or if we check your criminal background record or check your licen- 
sure and determine that you’re not appropriately licensed or you 
have a relevant felony conviction that would keep you out of the 
program, then indeed we deny your enrollment application. 

Mr. Cummings. OK. Let me ask you about the agency’s dem- 
onstration program on power mobility devices. How does the agen- 
cy’s prior authorization demonstration for power mobility devices 
complement CMS’s Program Integrity efforts? 

Dr. Agrawal. Sure. Thank you for the question. So one of the 
central challenges in the improper payment rate is that there is a 
disconnect between the medical record documentation that 
underlies a medical service or, you know, indicates what happened 
over the course of that medical interaction, and then the claim that 
comes in to CMS, essentially the bill for that interaction. What 
prior authorization does is allows us to ensure that medical neces- 
sity requirements and documentation requirements are being met 
on the front end before the service is even offered to the bene- 
ficiary. The demonstration, and generally the way we’ve ap- 
proached prior authorization is, again, to take a very risk-based ap- 
proach. The demonstration was implemented around power mobil- 
ity devices first. We are actually — we put out a proposed rule that 
would look to expand that to other high-cost DME supplies, and 
then there are elements in the President’s budget that look to ex- 
pand it to things like hyperbaric oxygen and scheduled ambulance 
transportations. But all of it is the same principle which the pri- 
vate sector uses every day of evaluating the service before it’s even 
provided, determining that it’s OK, and then the beneficiary gets 
the service and the provider gets paid. 

Mr. Cummings. Now, is the beneficiary adversely affected? 

Dr. Agrawal. I think that’s a really important aspect of this. So 
by checking on the front end before the service is even provided 
that the documentation’s appropriate and that medical appropriate- 
ness and necessity are there, it prevents the beneficiary from un- 
necessarily or potentially being on the hook for a denied claim. So 
the service was never provided, right? That way neither the pro- 
vider is on the hook for a service that they provided but then are 
not getting paid for, and the beneficiary is not on the hook for hav- 
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ing received a service that the provider’s not going to then get paid 
for. 

Mr. Cummings. Thank you, Mr. Chairman. 

Chairman Chaffetz. Thank you. The gentleman yields back. I 
now recognize the gentleman from Tennessee, Mr. Duncan, for 5 
minutes. 

Mr. Duncan. Well, thank you, Mr. Chairman. 

Mr. Estevez, just today. The Hill newspaper says in an article, 
before signing on to increased Pentagon spending to its highest 
level ever. Congress should insist on a serious effort to identify and 
address wasteful spending by the Pentagon. Among major Federal 
agencies, the Pentagon is the only one never to submit, let alone 
pass, a full audit. 

Another article said. Pentagon leaders have requested the step- 
up production of the F-35, the beleaguered jet fighter that has 
proven to be a massive drain on resources with no end in sight, 
$7.5 billion sunk into the F-35 in Fiscal Year 2014 alone, with 
massive cost overruns and egregious acquisition failures. 

Over the years. I’ve read so many articles about waste at the 
Pentagon, and I sometimes wonder if there are any fiscal conserv- 
atives at the Pentagon. 

What do you say — how much — do you have any estimate as to 
how much we’ve spent on the F-35 so far, and are you — are you 
concerned about this article that’s in The Hill today that talks 
about the wasteful spending by the Pentagon? 

Mr. Estevez. Thank you for the question. Congressman. First, 
we’re always concerned about any wasteful spending at the Pen- 
tagon. And we have a number of processes in place to address 
spending in general, including looking at our overhead and func- 
tions and looking at our acquisition processes. 

Let me address the F-35. I don’t have the number total spent to 
date. F-35 costs per plane have gone down below our estimation 
since it was re-baselined in 2010. It’s actually producing a pretty 
good airplane. And I think 

Mr. Duncan. You have 

Mr. Estevez [continuing]. The F-35 is stuck on old news. 

Mr. Duncan. You’re the principal deputy for acquisition. And do 
you have any rough guess as to how much we’ve spent on the F- 
35 thus far, a wild rough guess? 

Mr. Estevez. I’m going to have to get you that for the record. 

Mr. Duncan. You don’t know. 

Mr. Estevez. It goes back to 2004, Congressman. 

Mr. Duncan. Right. All right. 

Dr. Agrawal, I met last week with hospitals from east Tennessee, 
and they told me that many hospitals in Tennessee are either going 
to have to close or are about to go under or probably end up being 
sold to some big out-of-State corporations because of the unfairness 
in their Medicare wage index. And they said that the system that 
CMS has now rewards very expensive, inefficient hospitals and pe- 
nalizes hospitals that have held their costs down or that have con- 
tinually lowered their costs. Have you looked into this? I mean, 
it’s — the difference between what hospitals are being paid, say, in 
San Francisco or — in comparison to Tennessee or Mississippi or 
places like that, it’s just almost unbelievable. These hospitals are 
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being paid twice as much for some of — mostly the same type of 
work. What can you tell me about that? Are you — is CMS looking 
into this or concerned about these huge discrepancies at all? 

Dr. Agrawal. Yes. I appreciate the question. We do have proc- 
esses for hospitals and other providers to engage us in terms of 
wage discrepancies like that. I can tell you that we have a very 
proactive approach to, say, the misvalued codes that we know exist 
and reevaluating those codes, ensuring that our coding approach 
and reimbursement approach is really paying for valuable services 
that, you know, taxpayers expect that we all want the program to 
provide. 

So there is a — I think the core message is there is a process for 
doing that, and we’re happy to engage with hospitals and other 
providers on these kinds of questions. 

Mr. Duncan. Well, I’ll tell you this: I don’t have much time left, 
but years ago a hospital administrator in a small town in Ten- 
nessee, he told me, he said — he said if you don’t have hospitals, you 
don’t get doctors, and if you don’t get doctors, you don’t get people. 
And there are many rural hospitals that are really struggling in 
this country today because of these discrepancies between what 
they’re getting in comparison to some of the very wasteful, very in- 
efficient big city hospitals. And I think that’s something that you 
really need to take a look at, because it’s very unfair. And I could 
give you all kinds of statistics about that that I won’t bother you 
with today, but it’s getting to be a very serious problem in my 
State. 

Thank you very much, Mr. Chairman. 

Chairman Chaffetz. Thank the gentleman. We’re recognizing 
members based on seniority when we gaveled in, so the gentleman 
that’s up next is actually from South Carolina, Mr. Mulvaney. The 
gentleman’s recognized for 5 minutes. 

Mr. Mulvaney. Thanks, Mr. Chairman. 

Mr. Koskinen, when I sat down — this is my first hearing, and 
when I sat down to do the research on the GAO report, which is 
the subject of today’s hearing, I sort of got sidetracked. And I want 
to talk to you about some other things, because one of the things 
I found in doing the research was a report that I think just came 
out today, in fact, it’s being reported today, that your agency is re- 
porting that the tax refund fraud will be $21 billion this year. 
That’s up about 300 percent from just a couple years ago. And that 
number stunned me. 

Just out of curiosity, I think it’s more than we spent on the en- 
tire Department of Agriculture. You could run the Treasury, the ju- 
diciary, the SEC, the SBA, and your IRS with that money and still 
have a couple billion dollars left over. Mr. Estevez, just out of curi- 
osity, for your interest, I could buy you 140 F-35s on just on what 
we’re going to lose this year in tax refund fraud. You could run my 
State, South Carolina, for 3 years on that money. And that’s not 
all the fraud occurring in the IRS, it’s just the tax refund fraud. 

Anyway, that research led to the research that I wanted to ask 
you about, which is your testimony last week before the Senate 
where Mr. Grassley, Senator Grassley asked you some questions 
about the impact within the Internal Revenue Code and within 
your department of what the President has done on executive am- 
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nesty. And I think you went back and forth with Senator Grassley, 
and he asked you about people who are benefiting from the am- 
nesty claiming the Earned Income Tax Credit in arrears for up to 
3 years. Are you familiar — you remember that testimony with Sen- 
ator Grassley? 

Mr. Koskinen. I do. 

Mr. Mulvaney. And I don’t know if we established what that 
would cost. Have you had a chance to figure out what the total cost 
of that program would be? 

Mr. Koskinen. I have not, but before I get there, I don’t know 
where the $31 billion in refund fraud came from. 

Mr. Mulvaney. $21 billion. 

Mr. Koskinen. $21 billion came from. As GAO testified, we 
stopped last year about $16 billion worth of refund fraud and only 
$5 billion is our estimate. What went through, which is still a big 
number and we’re worried about, but it isn’t $21 or $31 billion 
that’s going out the door. 

Now, with regard to the question you asked earlier 

Mr. Mulvaney. Yes. 

Mr. Koskinen [continuing]. To be eligible for the Earned Income 
Tax Credit, you have to work. It’s in the Earned Income Tax Cred- 
it. 

Mr. Mulvaney. Correct. 

Mr. Koskinen. To be able to apply for it, you have to have a So- 
cial Security number. 

Mr. Mulvaney. OK. 

Mr. Koskinen. So if you are — there are — we have about 700,000 
ITINs out there by illegal immigrants who are paying taxes 

Mr. Mulvaney. Correct. 

Mr. Koskinen [continuing]. But they’re not eligible to apply, be- 
cause they don’t have a Social Security number. 

Mr. Mulvaney. But several million of them well get Social Secu- 
rity numbers under the new program, right? 

Mr. Koskinen. And under the new program, if you get a Social 
Security number and you work, you’ll be eligible to apply for the 
Earned Income Tax Credit. You will get an amount depending on 
your situation. If you’re an individual working and applying for the 
individual tax, the maximum you can get will depend — it’s been in 
the range of about $500 or $600. 

Mr. Mulvaney. Right. Let’s slow down a little bit, Mr. Koskinen, 
because there was some apparent lack of clarity in the interpreta- 
tion of what you said in the Senate. I want to clear this up. 

Is the Earned Income Tax Credit only going to be available to il- 
legal immigrants who filed taxes previously or is it going to be 
available to all of them who receive Social Security numbers under 
the new program? 

Mr. Koskinen. It turns out there was a lack of clarity about 
that. If you get a Social Security number, you can then file for this 
year if you’re working; and if you earned income in the 3 years be- 
fore that and filed, you’ll be eligible; if you did not file, you’ll have 
to file a return and you’ll have to file to demonstrate with the same 
information you would — anybody else would that you actually 
earned income and therefore were eligible. 

Mr. Mulvaney. So if you 
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Mr. Koskinen. There’s some assumption that you would get the 
Earned Income Tax Credit automatically whether you were work- 
ing or not. 

Mr. Mulvaney. So it will he available to everyone who was 
working, even if they didn’t file the previous 3 years? 

Mr. Koskinen. That is my understanding, yes. 

Mr. Mulvaney. And you have no idea how much this is going to 
cost? 

Mr. Koskinen. I don’t now how many people are going to be — 
get Social Security numbers, how many will be single 

Mr. Mulvaney. Sure. But we do this all the time. Did the White 
House not ask you to estimate that? 

Mr. Koskinen. I haven’t talked to the White House about this 
at all. 

Mr. Mulvaney. Did anyone at the White House ever consult 
with your office before they issued the executive orders that gave 
rise to the executive amnesty? 

Mr. Koskinen. They didn’t consult with me and, to my knowl- 
edge, they didn’t consult with anyone else. I’m not aware of any 
consultation. 

Mr. Mulvaney. Are you aware that if we were to do what the 
President did by legislation that he did by executive order, that we 
would have to go and get an estimate of exactly what you and I 
are talking about here today? 

Mr. Koskinen. From the Joint Committee on Taxation? 

Mr. Mulvaney. Or CBO, yes. 

Mr. Koskinen. Or CBO. Yes, sir. 

Mr. Mulvaney. So if we did the same thing the President did, 
by law, we would have to know the answer to that question, but 
the President doesn’t have to know the answer to that question be- 
fore he did what he did. 

Mr. Koskinen. The President may know the answer to that we. 
He wouldn’t come to us necessarily to get the answer; he would go 
to 0MB. 

Mr. Mulvaney. But by the same token, he didn’t ask you for any 
input. Did he ask you, for example, about any increase in the risk 
of fraud? 

Mr. Koskinen. No. We had no conversations with the White 
House that I’m aware of. I certainly personally have not talked — 
I’ve never talked to the White House about any of this. 

Mr. Mulvaney. All right. Thank you, Mr. Koskinen. I appreciate 
that. 

Chairman Chaffetz. Thank the gentleman. Now recognize the 
gentleman from Ohio, Mr. Jordan 

Mr. Jordan. I thank the 

Chairman Chaffetz [continuing]. For 5 minutes. 

Mr. Jordan. I thank the chairman. And I wanted to talk about 
the IRS targeting of conservative groups and, frankly, the pattern 
of deception and delay that we’ve seen from this administration. 
And I would just remind you, you don’t take my word for it. Just 
yesterday in The Hill, front page. Feds won’t release IRS targeting 
documents. So don’t take my word, take Bob Cusak, editor of The 
Hill, respected mainstream journalist, talking about the deception 
and delay from this administration. 
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I think it’s important we remember the whole saga here. Feb- 
ruary 2012, Lois Lerner told this committee staff that there was no 
targeting going on. Turned out to be a lie, of course. March 23d, 
2012, Doug Shulman, then-Commissioner, told the Ways and 
Means Committee he could give assurances that there’s no tar- 
geting going on; also, a false Statement. May 2013, that day when 
Lois Lerner went in front of a bar association here in D.C. with a 
planted question, again, unprecedented, to get in front of the story; 
went before the inspector general released a report and talked 
about the targeting by the IRS of conservative groups. And I quote 
from — remember, she talked to Treasury and the White House 
about this. From Mr. Cusak’s article yesterday, and I quote. Then- 
chief of staff Mark Patterson at Treasury informed the White 
House about the plan to disclose the targeting, ’so that the White 
House wouldn’t be surprised by the news.’ 

So think about this: planted question before the inspector gen- 
eral’s report comes out, she discloses that, and the White House 
and the Treasury already knew it was going on. And then, of 
course, we have Ms. Lerner talking about Cincinnati was the prob- 
lem and not Washington. That was false. And the White House 
says it’s a phony scandal, no corruption, not even a smidgeon, 
which brings me to Mr. Koskinen, the current Commissioner. 

February 14th of last year, we subpoenaed you for all of Lois 
Lerner’s emails. Put up slide No. 1. Just a few weeks later, March 
26 in this committee room, the chairman of the committee, Mr. 
Chaffetz, asked you a question: Are you going to provide all of Lois 
Lerner’s emails? And your response was, yes, we will do that. 

Do you remember that conversation, Mr. Koskinen? 

Mr. Koskinen. I remember that conversation. You’ve reminded 
me of it a couple of times. 

Mr. Jordan. Yes. And I’m going to keep doing that, because the 
American people are frustrated and mad about what the IRS did 
to them regarding their First Amendment free speech rights. 

June 13, you sent a letter to Senate Finance saying, we lost Lois 
Lerner’s emails and destroyed — the hard drive’s been destroyed 
and the tapes are destroyed. You remember that letter you sent to 
Senate Finance, Mr. Koskinen? 

Mr. Koskinen. I do remember. 

Mr. Jordan. 10 days after that letter was sent, you came back 
to this committee room and we asked you some questions. Put up 
the second slide. I asked you specifically, what date did you learn 
you couldn’t get all her emails? Remember that conversation, Mr. 
Koskinen? 

Mr. Koskinen. I remember that conversation. 

Mr. Jordan. And your response was, I learned in April. 

So my question to you is, today will you admit that you misled 
this committee, the U.S. Congress, and more importantly, the 
American people just like Ms. Lerner was doing, just like Mr. 
Shulman was doing? Will you admit that you misled the Congress 
and the American people? 

Mr. Koskinen. No. Absolutely not. 

Mr. Jordan. You don’t think you misled them? 

Mr. Koskinen. No. 
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Mr. Jordan. So you told Mr. Chaffetz, yes, we’ll give us all — give 
you all her emails. A few days later, you learned in April — that was 
March. In April, you learned you can’t, and you wait 2 months to 
tell us, and you don’t think that’s misleading the American people? 

Mr. Koskinen. I do not. And we waited 6 weeks to tell you, and 
we waited those times to find as many of the emails as we could. 
And as we reported 

Mr. Jordan. Have you sent 

Mr. Koskinen. Let me complete. 

Mr. Jordan. Let me ask you this. 

Mr. Koskinen. I 

Mr. Jordan. Have you sent the chairman a letter saying what 
you told him on March 26, yes, we will get you all of Lois Lerner’s 
emails, have you sent Chairman Chaffetz a letter saying, you know 
what, what you told you on March 26 isn’t true? 

Mr. Koskinen. As I noted in the hearing, we’ve had several hear- 
ings, I — and I still tell you, we said we would give you all the Lois 
Lerner emails. We gave all the Lois Lerner emails we had. As I 
told you once before, we couldn’t make up Lois Lerner emails. We 
didn’t have them to produce them. We gave you all the emails that 
we had and we continue 

Mr. Jordan. What you said, you said I’ll give them 

Mr. Koskinen [continuing]. To give you those. 

Mr. Jordan [continuing]. All to you, and then you — then you 
write a letter to the Senate Finance saying you lost them, you de- 
stroyed them. Have you done anything to correct the record? 

Mr. Koskinen. Actually, we didn’t lose them and destroy them. 
They were lost in that period of time in 2012. And then when we 
testified, testified in June, I testified that we waited the 6 weeks 
while we tried to provide you as much emails as we could, and 
there were 24,000. 

Mr. Jordan. Let’s put up — put up — put up slide 4. Put up slide 
4. 

This is the letter you sent, and you said, you can confirm that 
no backup tapes existed. So you confirmed that you couldn’t get us 
all her emails, and you’ve done nothing to correct the record when 
you told Mr. Chaffetz you were going to give all them to us. And 
you waited 2 months before you ever told us that you lost them. 

Mr. Koskinen. I waited 6 weeks so we could provide you all the 
emails we could find. We’ve provided you 24,000 emails from the 
time of her hard drive crash, and we said and the backup tapes did 
not exist because they had been re-recorded over. 

Mr. Jordan. Mr. Chairman, I 

Mr. Koskinen. So we at that time gave you all the emails we 
had. 

Mr. Jordan. I got one more question, Mr. Chairman, just in the 
last 10 seconds, if I could. 

Have you withdrawn the letter — understanding that now TIGTA 
has told us that her emails are recoverable on the backup tapes, 
have you withdrawn the letter that you sent to Senate Finance 
where you confirmed that those tapes weren’t there? 

And I bring this up, Mr. Chairman, because this committee has 
some experience with letters being withdrawn. In 2011, the Justice 
Department, after making inaccurate Statements regarding Fast 
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and Furious, sent a letter to then-Chairman Issa and they said 
this: Facts have come to light during the course of this investiga- 
tion that indicate the letter, the February 4 letter, contains inac- 
curacies. Because of this, the department now formally withdraws 
the February 4 letter. 

So what I want to know, Mr. Koskinen, is when are you going 
to be square with the American people and withdraw false and 
misleading Statements you’ve sent this committee, and more im- 
portantly, the letter you sent to Senate Finance? Are you going to 
withdraw that letter? 

Mr. Koskinen. Absolutely not. We can have that argument for 
a long time. TIGTA, by the way, has spent 6 months and untold 
amounts of money trying to extract those emails from those backup 
tapes. So the idea that we could somehow 

Mr. Jordan. You said you could confirm they didn’t even exist. 

Chairman Chaffetz. The gentleman 

Mr. Koskinen. I said the backup tapes — if you go through my 
records, you will find I’ve said the backup tapes 

Mr. Jordan. Will you withdraw the letter that had falsehoods in 
it? That’s what I’m asking. 

Mr. Koskinen. There is no reason. There are no falsehoods and 
there’s no reason to withdraw that letter. I stand by that letter. 

Chairman Chaffetz. The gentleman’s time has expired. I now 
recognize the gentleman from Michigan, Mr. Walberg, for 5 min- 
utes. 

Mr. Walberg. Thank you, Mr. Chairman. 

Mr. Koskinen, Monday and Tuesday of this week, I did two live 
town halls back in my district and one tele town hall, and at two 
of those events, the issue that was brought up, the same story that 
came out in The Washington Post with the headlines, IRS Rehired 
Hundreds of Ex-Employees With Troubled Records, came up. And 
it basically came up from my constituents saying, you know, why 
can we not get away with the same things that were recorded 
there? 

In the article, it indicated that between 2010 January and Sep- 
tember 2013, the IRS rehired 7,000 employees. A great jobs pro- 
gram, and we’re always delighted when people are employed, but 
the question comes from my people as to why over 800 of those 
7,000 rehired IRS employees were rehired with prior substantial 
employment issues, including 11 individuals who engaged in unau- 
thorized access to taxpayer information. And that really discour- 
ages and frustrates my citizens that these people, 11 of them who 
engaged in unauthorized access to taxpayer information, which is 
a crime, as we understand it, were rehired. Why? 

Mr. Koskinen. Those are — the bulk of those employees are tem- 
poraries or seasonals who are hired for 4 to 6, 8 months a year de- 
pending on the time. They should not be rehired. 

Mr. Walberg. Even though they committed a crime, you’re say- 
ing they should not — why were they rehired? 

Mr. Koskinen. They shouldn’t. Because the process at that point 
in time in 2009 or 2011 into 2012 followed, as the IC said, the 
0PM rules and regulations, which, in fact, would have allowed 
those people to be applied. 
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We consolidated in 2012 all of those hiring issues into our per- 
sonal security division, and I have made sure that if you have vio- 
lated the alls under a section called 1203(h), if you have worked for 
the IRS and violated Section 1203(h), you will not he rehired. 

Mr. Walberg. Well, according to TIGTA, they said, it still re- 
mains a concern, because in 2012 and 2013, IRS hired individuals 
with prior significant IRS substantiated conduct and performance 
issues. 

What are you doing — I mean, this was subsequent to that. 

Mr. Koskinen. Yes. And what the IG recommended, the IG, 
again, in that report said that was all pursuant and we followed — 
pursuant to when we followed the 0PM rules. What the IG said is 
we should make sure that we make sure before we hire someone, 
we’ve actually reviewed all of this. And as I said, we now do that. 
We took the IG’s recommendation. And I have talked with our per- 
sonnel people since the IG started raising this issue, which I think 
is an important issue, in December, and to make sure that — and 
this consolidation with our personal security people, if you have 
violated 1203(b), which is willful violations of taxes or access to 
taxpayer information, you won’t be hired. 

Mr. Walberg. Let me proceed further, then. And I hope this is 
a general trend. The audit identified 141 individuals that were re- 
hired that had a prior tax issue, with five of them having been 
found by IRS management to have willfully not filed their taxes. 

How many of these employees are still working? 

Mr. Koskinen. They’re all seasonal employees, so I don’t know. 
A lot of them don’t come back the next year, so I don’t know how 
many of those there were. I would note that the 141 — we take the 
requirement of IRS employees to be tax compliant very seriously. 
Our compliance rate is over 99 percent. We hold people account- 
able. Even if their mistakes are inadvertent, even if they make 
modest mistakes, we count that as not-compliant. The — what we 
are concerned about is the five employees you mentioned that have 
willfully — have been found to willfully not pay their taxes and vio- 
late the tax laws, and those people are subject to termination. 

Mr. Walberg. Could you get us information for this committee 
of people we’re referring to here that are still employed? 

Mr. Koskinen. I can find the information. The 141, if you had 
a minor attempt — minor mistake, those you would get cited for, but 
those aren’t basis for termination. The five you mentioned that had 
a willful violation finding, I will find out the information and get 
it back to you. 

Mr. Walberg. I appreciate that. What about — what about those, 
not the tax issue, but had substantial prior employment issues, at- 
tendance issues, misrepresentation of what they were doing if they 
were on the job? 

Mr. Koskinen. There’s again — again, as I say, the consolidation 
now, we have a personal security department that reviews every 
offer before it is made to make sure that we’ve gone over all of 
that. Some — again, some personal activities are you didn’t show up 
to work, you know, for 2 days, others are you had a significant 
problem. And we distinguish between those. And the 0PM rules 
are very clear about that, that if you’ve — just because you’ve had 
a performance issue in your file doesn’t mean you can never work 
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again for the IRS. It depends on the nature and the duration of the 
affair. But it is important for people to he confident even though 
80 percent — as the TIGTA report said, 80 percent of these people 
are temporaries and seasonals who don’t necessarily work even for 
half the year, it is important for us to make sure 

Mr. Walberg. Very important. 

Mr. Koskinen [continuing]. That we have the appropriate people 
working, and so I take the TIGTA report — I’m a big supporter of 
IGs, because they continue to review these issues. And we take it 
seriously. We have implemented their recommendations. We are — 
we have a personal security group now that ensures before an offer 
goes out, if you have violated 1203(b), which is the two most seri- 
ous issues, you don’t get hired. And if there are other conduct 
issues, not only are we going to follow the 0PM rules, we’re going 
to review those for appropriateness for work at the IRS. And I 
think it’s important for people to be comfortable that we do take 
it seriously and that people working for the IRS ought to be tax 
compliant. If we’re collecting your taxes, we ought to be paying 
ours. 

Mr. Walberg. Well, I appreciate that. And I would like the infor- 
mation on those that are still employed that came under these 824. 

Mr. Koskinen. Well, the 824 covers a large range 

Mr. Walberg. A lot of lot. 

Chairman Chaffetz. I thank the gentleman. 

Mr. Walberg. Thank you. 

Chairman Chaffetz. The gentleman’s time has expired. We now 
recognize the gentleman from Alabama, Mr. Palmer, for 5 minutes. 

Mr. Palmer. Thank you, Mr. Chairman. Thank you, Mr. Chair- 
man. 

I want to give Mr. Koskinen a break here for a minute and talk 
with Mr. Lightfoot, if that’s OK. 

Mr. Koskinen. I don’t want you to think that’s not appreciated. 

Mr. Palmer. Well, that doesn’t mean I won’t come back to you. 

Mr. Lightfoot, NASA’s done a good job in making progress on get- 
ting off the high-risk list, but there are still some issues. I’m obvi- 
ously from Alabama. NASA’s a major presence in our State, but 
there have been some issues with re-baselining costs and schedule 
on — in light of management and technical issues, can you address 
that, on some of your projects? 

Mr. Lightfoot. Yes, sir. We have — the process we go through 
where we review these projects on a routine basis. We have some — 
while we’ve had some that have done really well, we continue to 
make good progress on those, eight out of the last nine that have 
a launched that came in under the baseline. Once we issue — once 
we go through confirmation, what we call confirmation of a project, 
which moves it from formulation to development, that’s when we 
make a commitment for a certain cost and schedule that we’re 
going to try to live to. 

The process we have where we review those all monthly. Occa- 
sionally we have one that pops up and is — it gives us an issue. 
We’ve had two of those. The space ground sustainment system that 
we have, and then the ICESat-2 project, which are two — two issues 
we have going where we were required to then go back and base- 
line. When you re-baseline, you go through a process of analysis of 
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alternatives, is there another way you can get that particular mis- 
sion accomplished, can you de-scope the existing mission so that 
you can still stay within that cap. So that’s the process we go 
through. Each one of those has lessons. Those lessons — one of the 
things that we’ve been really working on is the — factoring those 
back in and continuing to improve our process as we go forward for 
the rest of those projects. 

Mr. Palmer. At a prior time in my life, I worked for a couple of 
major engineering companies, and one of the things that drives a 
client crazy, particularly one paying the bill, is change orders. 
You’ve got some projects that I don’t know if it’s a result of design 
changes or poor design to begin with that are running some sub- 
stantial overruns on change orders. Could you address that? 

Mr. Lightfoot. Yes, sir. I think the one you’re talking about in 
particular is the ground systems project that we had. This was the 
first time that we’ve actually applied the same project management 
methodology that we had for the spacecraft that we’ve been flying 
to a ground system. And one of the things — that’s an upgrade to 
our ground networks that actually communicate with all the sat- 
ellites we have on orbit. That system is basically becoming obso- 
lete. So what we did is we went out and we tried — we knew we had 
a pretty large job in front of us, and we tried those program project 
techniques that we’ve been — that we’ve been doing for spacecraft, 
one of a kind things, to a ground system. 

We’ve learned a few lessons in that process. The No. 1 one is 
that — or the first one is that we have to be very clear on our re- 
quirements, much to what — much to what you’re talking about, 
and understand what the — and make sure we understand that the 
contractor that’s doing that work understands those requirements 
as well. So we’ve gone back and forth with this in terms of trying 
to define better the — what the expectations we have for the con- 
tractor and then managing that contractor. 

In this particular case, we’ve — we’ve changed out the entire con- 
tract management team and the team that we have in terms of 
our — our managing it. And since we’ve done that, we’ve — it’s — we 
have managed to stay — from an earned value perspective, we 
stayed at the levels that we expected. 

Mr. Palmer. So this is — would you say this is the result of a de- 
sign that — that a — of a project that the schedule dictated the de- 
sign, or is this something where you’re entering a new area and — 
and you’re — and you’re designing as you go? 

Mr. Lightfoot. No. I think this is a case where we underesti- 
mated the type of work we needed to do to deal with the obsoles- 
cence issues that we had in front of us in terms of designing the 
software system that we were putting in place with the new equip- 
ment. 

Mr. Palmer. All right. I believe that’s all I have. I’ll yield the 
balance of my time. 

Chairman Chaffetz. The gentleman yields. I now recognize the 
gentleman from Georgia, Mr. Hice, for 5 minutes. 

Mr. Hice. Thank you. Chairman. 

And Mr. Koskinen, since you had a break, I thought it only ap- 
propriate to come back to you and ask you a couple questions that 
were on my mind in particular. 



128 


Based on the previous testimony, you’ve made it clear that the 
ability of the IRS to make progress in the areas that have been 
outlined by the GAO have been largely hindered due to reductions 
in funding. And I — this is kind of a personal question to me be- 
cause of my involvement with non-profit organizations. And the 
IRS has spent millions of dollars to basically rewrite the governing 
rules for 501(c)(4)’s or what — what have you, different non-profit 
organizations, specifically potentially removing tax-exempt status if 
those organizations are involved in political activity. 

My question is multiple. It’s rather amazing personally that 
there would be an issue of trying to hinder speech of Americans. 
My specific question really comes down to, how much money — can 
you tell me how much money the IRS has spent on writing and the 
attempt to rewrite that specific section of the 501(c)(4) ruling? I 
know it was withdrawn, but my understanding is that there is an 
attempt now to rewrite that. I’m curious how much money has 
been spent to that end. 

Mr. Koskinen. I don’t know. The only money that’s being spent 
is the lawyers that have been working on the drafting of that, and 
that’s not — they haven’t been spending full-time, so it is not a large 
amount, but I could try to get an estimate of how many people 
worked on it. Some of it — the work on the first version was done 
before I got there, but if you’d like, we can try to figure out on a 
rough estimate as the man-hours, but the only time spent was, as 
I say, a relatively small number of lawyers who were working on 
it. 

But I would note that the goal here is not to hinder. As said 
when I started and kind of inherited all of this, the goal is, in fact, 
to try to make clear what the rules are in a way that is fair to ev- 
erybody, all of the organizations, it’s clear and easy to administer. 
Right now, the rule that’s been there a long time is you judge both 
the determination as to whether you’re eligible to be a 501(c)(4) 
and then whether you’re performing under the statute by facts and 
circumstances. So that means anytody running an organization is 
running the risk, looking over their shoulder saying, is somebody 
going to have a different view of the facts and circumstances. So 
my sense is we ought not to be hindering political speech, we ought 
not to be changing the way people act, but what we ought to have 
is a much — and the IG, in his recommendation, said the Treasury 
Department and the IRS should clear up what the standard is for 
what amount, how much, and what the definition is of the political 
activity you can engage in. And my sense is that it ought to be pos- 
sible to have a rule that would be clearer, easier for people in those 
organizations running them to understand, and fair to everyone, 
and that would not be hindering political speech. So it’s not my in- 
tention, anyway, in looking at that to do that. 

My sense and concern is that the present system has, over the 
last several years, by the IG’s analysis, turned out to be unwork- 
able, and I think it would be in everybody’s interest if, again, it 
could be clearer what the rules are without hindering people, and 
they would be able to run organizations confident that somebody 
isn’t going to come in and second-guess them on the facts and cir- 
cumstances that they’ve been operating under. 
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Mr. Hice. Well, I would agree we certainly need clarification in 
that, but I would also strongly urge a very clear understanding of 
the freedoms of Americans, that just because someone is a part of 
a non-profit organization, they have not waived their First Amend- 
ment rights. And that is a tremendous threat that the IRS has, in 
my opinion, no business interfering with, and that is a deep con- 
cern. 

Mr. Koskinen. I agree with you. And, in fact, my sense is that 
the rules if they’re fair and clear to everyone will, in fact, create 
less of a constraint on people’s right to free speech than the present 
rules, which are muddy and hard to interpret. 

Mr. Hice. OK. One other question, and I will yield my time. 
Again, going back to the issue that the main problem has been lack 
of funding. The issues from the GAO have come up with the IRS 
for some 25 years or close to it. It’s been a long time that we’ve 
had issues, and yet a few years ago, in 2010, the IRS had more 
funding than they’ve ever had, and these problems, these issues 
have still not been addressed. 

Mr. Koskinen. Well, that’s not quite true, because we did have 
more money in 2010 by a long shot. And as I noted in my testi- 
mony, in 2013, as a result of some of that spending on information 
technology, the information technology business system moderniza- 
tion proWem for the IRS was taken off the high-risk list after hav- 
ing been there for 14 years. So it has been true and proven that 
in — certainly in the IT area, that if we have the funding, we can 
make significant progress. 

Mr. Hice. And that’s great for the IT area, but there’s many 
other areas that need to addressed, and 25 years is far too long. 
It’s time to put some teeth to it, sir. Thank you. 

Chairman Chafeetz. Thank the gentleman. I now recognize the 
gentleman from Florida, Mr. DeSantis, for 5 minutes. 

Mr. DeSantis. Commissioner Koskinen, it was a year ago where 
the senior IRS leadership learned that Lois Lerner’s hard drive had 
crashed, there was an issue about getting her emails off backup 
tapes. You wrote a letter to Senate Finance in June 2014 saying 
that there were problems with Lerner’s emails and that the backup 
tapes have been — had been destroyed. And then on June 20, you 
testified before the Ways and Means Committee that the IRS went 
to “great lengths” and made “extraordinary efforts” to recover 
Lerner’s emails. 

So let me ask you this: After the IRS became aware that Lerner’s 
hard drives had crashed, what specific steps did the IRS take to 
locate any backup tapes or disaster recovery tapes? 

Mr. Koskinen. The disaster recovery tapes that the IRS are re- 
corded over when they’re used until they’re no longer useable, so 
there is no technique or capacity in the IRS to actually retrieve 
emails off of those tapes. What we did do was go to everybody in 
the what so-called custodial list at that point of about 80 different 
people that Ms. Lerner would have been communicating with, be- 
cause we were looking for all emails. We’d already produced all the 
emails that were relevant to the determination process. We were 
then trying to respond to “all.” So we looked at all of those 82 and 
took every email that was to or from Lois Lerner, compared them 
against emails already produced 
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Mr. DeSantis. But that would not have been backup tapes. That 
was from their hard drives or their account. 

Mr. Koskinen. That was their hard drives we produced 

Mr. DeSantis. So the hard — so the backup tapes, you had made 
the judgment that they simply were not going to be recoverable, or 
did you actually have somebody investigate whether you could have 
backup tapes or you could find some backup tapes? 

Mr. Koskinen. Our expert said we had no way, that they were 
not recoverable. It’s taken the IG 6 months, the last 2 or 3 months 
working, he tells us, around the clock, and he still hasn’t gotten 
them produced and we still don’t know how many there are. But 
my position all along has been with the IG, because we helped him 
find what the backup tapes were that had been recorded over from 
that time, is if we could find more emails, that would be terrific. 
And I actually mean that seriously, because it would lend even 
more light than the 24,000 we already produced into what were in 
those emails in that timeframe. So we 

Mr. DeSantis. Why would the IG be able to find it if you guys 
couldn’t find it? You said you went through extraordinary lengths. 

Mr. Koskinen. Well, because the IG — when we discovered this in 
the spring and then we reported it in June 6 weeks later, within 
a couple weeks thereafter, the IG started his investigation, so we 
had no more time. And I will tell you today, if we started today, 
it’s taken the IG — and I don’t know how much money they’re 
spending. It’s taken them over 6 months to, in fact, recover what- 
ever they’re going to report, and that was 

Mr. DeSantis. So let me ask you this: Did the IRS 

Mr. Koskinen. We don’t have that capacity. 

Mr. DeSantis. Did the IRS ever collect any tapes or send any 
backup tapes to any forensic lab in your investigation, the people 
you detailed to do this? Was that — any tapes recovered, any tapes 
ever sent to a lab by the IRS? 

Mr. Koskinen. No. 

Mr. DeSantis. OK. Now, who told you that the backup tapes 
would not yield any emails from Lois Lerner’s crashed hard drive? 

Mr. Koskinen. I was told that by our information technology de- 
partment. 

Mr. DeSantis. And what was — do you know the basis for that 
Statement? Did you inquire as to how they could be sure of that? 

Mr. Koskinen. Basically what they described to me was they 
have these disaster recovery tapes, they are actual tapes, and then 
when the 6 months — they keep them for 6 months, and when the 
6 months is done, they simply reuse them and record over them. 
And as you know if you ever had tapes, when you record over 
them, then in the normal process, they’re — data underneath them 
is gone. And, in fact, I was told that we had no capacity and no 
way that you could actually recover those. And, in fact, they were 
not sure that there was any way you could recover them. 

Mr. DeSantis. Has the IRS communicated with Lois Lerner, her 
attorneys about recovering the emails from any of her crashed hard 
drives? 

Mr. Koskinen. No. I’ve had no communication with Lois Lerner 
about this at all. I’ve never met her. 
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Mr. DeSantis. Let me ask you this: In the course of the IRS’s 
response to this committee’s investigation, has the IRS withheld 
any information or documents from Congress on any other basis 
other than 6103? 

Mr. Koskinen. No. We’ve had some that we’ve asked the staff to 
review in camera because there are basically personal matters that 
have nothing to do with the investigation, but we’ve exercised no 
privilege, we aren’t trying to keep anything from you. In fact, we’ve 
continued to respond to requests and continue to provide any infor- 
mation we can find. 

Mr. DeSantis. And you would say that your responses to the re- 
quests from this committee have been above and beyond what is 
required in this situation? 

Mr. Koskinen. No, I don’t think they were above and beyond. We 
have — when you want information in escrow, we’ve have an obliga- 
tion to do our best to provide it, and we’ve done that. I don’t think 
that’s above and beyond. Any time you want 

Mr. DeSantis. Extraordinary efforts aren’t above and beyond? 

Mr. Koskinen. Extraordinary efforts were, in fact, when we dis- 
covered the crash, then it was my decision and thought that we 
needed to do whatever we could to fill in that gap, and we did find 
24,000 emails we provided. My understanding from news reports, 
because the IG doesn’t tell us a lot of stuff about this, is that the 
IG may be able to find another 9-or 10,000 Lois Lerner emails. 

Mr. DeSantis. So you’ve just — final question is, you’ve made the 
effort. You were not cavalier about this. You made the effort to find 
what the committee wanted. Is that your testimony? 

Mr. Koskinen. That’s my testimony. 

Mr. DeSantis. Thanks. I yield back. 

Chairman Chaffetz. Thank the gentleman. We’ll now recognize 
the distinguished gentleman from South Carolina, Mr. Gowdy, for 
5 minutes. 

Mr. Gowdy. Thank you, Mr. Chairman. The book of Ecclesiastes 
teaches us there’s a time and a season for everything, and you con- 
vinced me earlier this evening that this is not the time to question 
Mr. Koskinen. He was here for GAO-related testimony and not 
IRS. And I don’t know whether he’s prepared for the questions or 
not, but we’ll not find out, because I believe that you have agreed 
at some point he’s going to come back before the committee. And 
I was wondering if the chairman might engage in a colloquy with 
me to make sure that my chronology is correct. 

I thought the last time that Commissioner Koskinen was in front 
of us, there was a robust discussion about the time period within 
which he was going to produce emails, and he had asked us to nar- 
row the scope so that he could prioritize and get us those emails 
that we had asked for. And, of course, as the chairman will recall, 
we need those emails, because the emails we do have from Lois 
Lerner contain such jewels as lamenting GOP wins, celebrating 
Democrat wins, forecasting gloom and doom if the GOP, God forbid, 
ever controlled the Senate, saying that we needed a plan to over- 
come Citizens United. 

Those were just some of the emails that I recall, Mr. Chairman. 
And if my chronology holds, after Commissioner Koskinen told us 
that he would prioritize the production of those emails, of course. 
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they — they magically disappeared. And then the IRS, of course, Mr. 
Chairman, employed Herculean efforts to recover those emails. 
They were not successful, but then talismanically after the election, 
or just talismanically, they did appear at some point, and now we 
are reading that 500 of those emails will not be made available due 
to the invocation of a privilege. 

Does the chairman know what privilege the White House is rely- 
ing upon to not produce those documents to Congress? 

Chairman Chaffetz. I do not. 

Mr. Gowdy. Do you think — do you know whether the President 
has had an opportunity to review those 500 documents? 

Chairman Chaffetz. That’s a good question. 

Mr. Gowdy. Do you think there is a chance that his conclusion 
that not a smidgeon of corruption exists in this investigation might 
be altered if he did have an opportunity to review what’s in those 
documents? 

Chairman Chaffetz. Certainly. 

Mr. Gowdy. Will you consider inviting Mr. Koskinen back to up- 
date us on this — on this chronology? 

Chairman Chaffetz. Yes, indeed. 

Mr. Gowdy. All right. Well, Mr. Koskinen, Commissioner, I’m not 
going to question you today, because I think the hearing title was 
something else, but I hope at some point we can go back to where 
we left off, which was an assurance from you that you were going 
to prioritize email productions. 

And I hope at some point, Mr. Chairman, we can evaluate the 
refusal to turn over certain documents to Congress, the invocation 
of privilege. And I hasten to add, as the chairman remembers be- 
cause of his service on Judiciary and Oversight, this administration 
has invoked executive privilege before only for us to then learn that 
that privilege was invoked to protect an email that the Attorney 
General sent to his wife. Under what theory of executive privilege 
is that email protected? 

So I hope that I live long enough to see the production of those 
emails, and I’ll certainly hope I live long enough to see the Com- 
missioner come back before us. And with that 

Mr. Cummings. Would the gentleman yield? 

Mr. Koskinen. Could I just make one clarification? During the 
course of all of the document production. Treasury Department 
turned over all of its Lois Lerner emails and the White House 
made a representation that they had no Lois Lerner emails. So in 
terms of that process, and, in fact, this committee issued a report 
in December noting that, in fact, there was no evidence that any- 
one outside of the IRS, whether at the White House or Treasury, 
had any impact or influence over the, as the IG said, improper use 
of criteria for the determination process for (c)(4)’s. So I don’t know 
what the documents over there are. There’s been litigation around 
the inspector general investigating communications, but that’s not 
a case between us and — the IRS is not a party to that 

Mr. Gowdy. No. 

Mr. Koskinen [continuing]. And I don’t 

Mr. Gowdy. No, it’s not, which is in part why I directed my ques- 
tions to the chairman and not to you 

Mr. Koskinen. Good. 
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Mr. Gowdy [continuing]. But if you would like us to have this 
conversation, I will ask you, do you understand why Congress 
wants those emails? Can you understand, as a trained attorney, 
why we might want access to all the documents? 

Mr. Koskinen. I can understand that. My understanding was 
that the White House some time ago certified there were no Lois 
Lerner emails and Treasury gave you all of their Lois Lerner 
emails. 

Mr. Gowdy. Well, then what are they claiming 

Mr. Koskinen. But I look forward to coming back and we’ll — 
we’ll have more occasions. I think this is my sixth appearance be- 
fore this committee. I look forward to the seventh, and we’ll talk 
about — and we’ll be delighted to give you an update. And I will be 
delighted if the inspector general can ever complete his work, it’s 
now going after 6 months, to produce those emails, because then 
all of us will learn what was in them. And I am — have been totally 
supportive of the IG. And my view really is, if there are emails that 
can be done, and the IG apparently — in the public press it’s been 
said has been able to find them, I think that will be a major step 
forward, and I look forward to discussing that with you. 

Mr. Gowdy. Well, I know I’m out of time, but you can appreciate 
our cynicism and our skepticism, because it appears as if some- 
times the strategy is just to delay and obfuscate and wait and wait 
and wait until either the public loses interest or until there’s a new 
administration. So I know you can appreciate our desire to have 
those documents sooner rather than later. 

Mr. Koskinen. I can. I thoroughly understand that. 

Chairman Chaffetz. I thank the gentleman. 

Mr. Gowdy. Thank you. 

Chairman Chaffetz. Gentleman’s time is expired. 

I will now recognize myself for 5 minutes. I haven’t had a chance 
to ask questions, and I would like to remind my colleagues why we 
are here. The five of you are very presentable. You put a happy 
face on the difficult situation, but here is the reality. Twenty-five 
years in a row your agencies, these problems, have come before 
Congress, 25 years in a row. This is the all-star team of problems. 
That’s the reality. You can try to put lipstick on this pig, but the 
reality is it is ugly. To get on this list, you have to be engaged in 
waste, fraud, and abuse in excess of $1 billion a year. 

Now, to get off the list, panted it is not easy, but here are the 
criteria for getting off the list: Leadership commitment, agency ca- 
pacity; you have to have an action plan; you have got to be moni- 
toring efforts and show progress. That seems like a reasonable five 
sets of criteria that you can accomplish. I have the scorecard ac- 
cording to GAO. Twenty-five years in a row you failed to meet 
those — hit the criteria on those five, and consequently that is why 
we are highlighting this. I think you are all well-intentioned. I 
think you are all very talented individuals, but the massive bu- 
reaucracy within the organizations that you represent here today, 
it is failing to meet these modest goals, and that’s what’s so frus- 
trating. Things are going to pop up, challenges are going to rise, 
but 25 years in a row is just not good enough. 

I heard you were making measurable progress. You know, six 
Sigma levels. Good news to report. I’m sorry. You don’t have good 
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news to report. The bad news is you’re back again. We don’t want 
to keep having these hearings. We want to show the progress, and 
I really do appreciate the good men and women who spend untold 
hours and literally years going through the details of what’s hap- 
pening within these departments and agencies. As a followup, I 
don’t expect you to do this off the top of the your head, one of my 
concerns is who’s held accountable? Like, who actually is held ac- 
countable? We asked, I think at the very beginning, one of our 
members asked a good question: Has anybody ever been fired? I 
think it was Mr. Hurd who asked. Has anybody been fired? Any- 
body dismissed? Anybody transferred by not meeting these goals? 

We have thousands of good quality people who work for the Fed- 
eral Government. These are employees that wake up, they’re patri- 
otic, they work hard, they’re trying to do their best, but somehow, 
someway in these five areas, it’s totally fallen down. We’re not 
achieving the goals. 

Again, the criteria put forward by the GAO doesn’t say that you 
have solve this. It seems to say that you’re on the trajectory to ac- 
tually getting it solved. So part of the followup that we would ap- 
preciate is who’s held accountable? What happens if you don’t meet 
these goals? Because some of these are astronomically large. I 
mean, we’re talking hundreds of billions of dollars. If you just 
take — you want to wipe out the Federal deficit? You just look at 
the uncollected taxes and the problems that we have in waste, 
fraud, and abuse going out the door through HHS. That more than 
wipes out all the deficit right just there. Just those two things. It’s 
not very easily done, but the waste, the fraud, the abuse, and you 
look at the people who work hard and pay their taxes and they’re 
doing everything that they can and then they hear hundreds of bil- 
lions of dollars going out that’s either not collected or going out er- 
roneously, and the waste, and the fraud, and the abuse, they throw 
up their hands. You know, their 2,500 bucks means something in 
their lives, and yet the numbers here are so big. 

I do not understand why the five that are highlighted here, 
there’s six programs, two at the Department of Defense, why you 
can’t hit those five goals. And according to the GAO, like the Medi- 
care program, they’ve only met one of the five goals, four partially. 
On the two DOD’s — DOD programs, met one of the five criteria. 
Four are partially met. At the Department of Energy, one partially 
met, one fully met, three not met at all. So 25 years in a row. I 
don’t want to come back and have this same hearing at the begin- 
ning of the next Congress. I want you all to solve it. 

The committee would like to know and hear from you how are 
you going to do that? How are you going to do that? And, again, 
difficult for you to answer, but I’m telling you, you all are giving 
a — painted a pretty picture. It ain’t so pretty, but we want to see 
what it is you’re actually doing. What is the action plan to create 
an action plan? That’s the hope and goal, and that’s — that’s my 
concern, and with that I want to yield back. I think — are there any 
members who wish to ask a second round of questions? 

Gentlemen from Ohio. 

Mr. Jordan. I appreciate the chair’s indulgence. If we could put 
up these two slides again, Mr. Koskinen, I just want to 
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Mr. Koskinen. I think it was noted by — agreed by Congressman 
Gowdy and the chairman that I’ll come back and we’ll have a full 
hearing about this, that we would not 

Mr. Jordan. No, we — I fully expect that. 

Mr. Koskinen. But I’m happy to answer more questions. That’s 
fine. 

Mr. Jordan. Yes. That’s the way it works. We call you here and 
we’re allowed to ask questions because the American people want 
to know why the Internal Revenue Service violated their funda- 
mental rights. So we appreciate your willingness to answer our 
questions on behalf of the American people. That’s awful big of you, 
Mr. Koskinen. 

Mr. Koskinen. Well, I’m just noting that we’re going to have an- 
other hearing on this, and I’ve had five hearings on it already, but 
I’m happy to answer the questions. 

Mr. Jordan. And we still haven’t got the truth, as evidenced by 
the headline yesterday, Mr. Koskinen. The press, the mainstream 
press can’t even get the documents they’re requesting. 

Mr. Koskinen. Those aren’t documents that they’re requesting 
from us. 

Mr. Jordan. But they derive from your unlawful activity. That’s 
the point, and that’s something you’ve got to understand. As the 
guy who heads the agency with as much power as you do, to have 
that kind of attitude, that’s what frustrates not just members of 
this committee, but all kinds of Americans. That, Mr. Chairman, 
that is the problem. 

Let’s go back to this, because I want to know something. This is 
what you told me when I asked you: When did you learn you could 
not get all of her emails, you learned in April. All right? Then you 
learned in April, and then let’s put up the next slide. This is the 
letter you sent to Senate Finance telling them — in June, you sent 
this letter telling them — and you used the word “confirmed” that 
no backup tapes — that backup tapes no longer exist. So I want to 
know between April, when you learned, and June when you told 
the Congress and the American people what you did to confirm 
that those tapes didn’t exist, which we now know do exist. So what 
did you do to confirm that the tapes didn’t exist, Mr. Koskinen? 

Mr. Koskinen. What I did was talk to our IT people who told 
me that when the tapes were finished with their 6 months, they 
were reused and then destroyed, and that as far as they were con- 
cerned, there was no way — we had no capacity even if we knew 
where they were to extract emails from them, and it’s taken the IG 
6 months and they still haven’t completed the process. 

Mr. Jordan. That’s all you did? You asked your IT people? 

Mr. Koskinen. Right. 

Mr. Jordan. Was it a long conversation? Did you ask them one 
question? How did 

Mr. Koskinen. I asked them questions about how the backup 
disaster recovery process worked. What happened to the tapes. 

Mr. Jordan. So the word “confirmed” is based on one conversa- 
tion you had with IT people. Is that what you’re saying? 

Mr. Koskinen. Yes. Those are the experts. They told me that 
there was no way that those tapes could be found or would be used 
because if they — they were reused 
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Mr. Jordan. That’s all you did? 

Mr. Koskinen. That’s all I did. 

Mr. Jordan. Really? An issue where repeated lies from Lois 
Lerner, false Statements given by Doug Shulman, the unprece- 
dented fashion in where you released the data ahead of the inspec- 
tor general’s report with the plan in question that you’ve already 
tipped off the Treasury and the White House about, and all you do 
to confirm you lost the most important documents from the most 
important person at the center of the scandal, all you do is ask a 
question of the IT people? 

Mr. Koskinen. We spent 

Mr. Jordan. That’s it? 

Mr. Koskinen. We spent 6 weeks looking at the hard drives and 
the documents for 82 people that 

Mr. Jordan. No, no, no, no. 

Mr. Koskinen [continuing]. To produce for you 24,000 more Lois 
Lerner emails. That was what we did was 

Mr. Jordan. Who was this person? This one conversation you 
had to confirm you lost valuable documents from the central figure 
in this entire scandal, who was this one person you asked that 
question to? Can you give us a name? 

Mr. Koskinen. That would have been Steve Manning, who’s the 
senior IT guy, and I asked him could we find — were those tapes 
available, and he said no, and then we decided what we could do 
is what we did do was we looked at all of the emails to and from 
Lois Lerner from 80 people and produced for you 24,000 emails. 

Mr. Jordan. No, I’m focusing on the words you used. “Con- 
firmed.” 

Mr. Koskinen. “Confirmed.” I told you, yes 

Mr. Jordan. “Confirmed” was one conversation with one IT guy 
that turned out not to be true, and here’s the big picture, your chief 
counselor, Kate Duvall, knew in February you had problems with 
Lois Lerner’s emails. You learned in April, and you didn’t tell us 
until June. So from February to June, you learned there’s big prob- 
lems, and the only thing you do to confirm that there are big prob- 
lems is one question to your IT guy. 

Mr. Koskinen. I knew in April we 

Mr. Jordan. About something where people’s fundamental rights 
were violated. 

Mr. Koskinen. Lot of time to get 24,000 emails for you, which 
was, at that time, we thought the most we could do, the best we 
could do, we thought. In fact, it was an extraordinary effort to go 
back through all of that to get you the additional 24,000 emails, 
which, by the way, you apparently don’t have much interest in 
them because they’ve been 

Mr. Jordan. One conversation, Mr. Chairman. One conversation 
with an IT guy, and he writes the U.S. Congress and tells the 
American people: We’ve lost Lois Lerner’s emails, and then one last 
question if I could, Mr. Koskinen. When did you learn from TIGTA 
that they had actually found these tapes and could recover her 
emails? 

Mr. Koskinen. I haven’t learned yet that they could recover. I 
learned that we helped them find — they went through the system 
and our people helped them find by the early part — late July, early 
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August they said they thought they had found the tapes from that 
time 

Mr. Jordan. Wait, wait, let me — this is an important point, Mr. 
Chairman. 

So literally a month after you — in July and early August, a 
month after you said “we confirmed that backup tapes no longer 
exist,” TIGTA had the backup tapes? 

Mr. Koskinen. TIGTA with our people 

Mr. Jordan. Within a month they got the tapes that you con- 
firmed didn’t exist? 

Mr. Koskinen. That’s exactly right. 

Mr. Jordan. Oh, my goodness. 

Chairman Chaffetz. Thank the gentleman. 

Mr. Cummings. Thank you very much, Mr. Chairman. I yield. 

Chairman Chaffetz. Recognize the ranking member. 

Mr. Cummings. You know, we can — you know sitting here and 
listening to all of this. I’m just trying to figure out how do we move 
forward. You know, you all been on the list for 25 years. It’s a long 
time. Administration after administration, and at some point, we 
need to get off this merry-go-round, and, you know, one of the 
things that I’ve noticed after being here for 18 years now is that 
there’s a tendency for — I think it was Mr. Gowdy who said it, or 
somebody up there, that folks wait for another administration or 
another Congress, and then we just recycle the same problems. 

And I guess my question is very simple to each of you: If you 
were — if you had a magic wand and you could get this done, what 
would you do to get yourselves off the list? I mean. I’m serious. I 
mean, what does it take, and what — if you were us, what would 
you do to get you off the list, or to have a kind of accountability 
that the chairman talked about? Because I got to agree with him. 
We’re better than this. And we’re just going round and round and 
round. We’re losing hundreds of billions of dollars. We’re wasting 
a lot of time, and it’s very frustrating, and I just believe — I mean, 
is it that we are too big to have accountability? Is it that we are 
too big to be able to say, OK. This is how it’s supposed to be done 
and we’re going to do it this way and we’re going to do it an effec- 
tive and efficient manner? 

I mean, you all may feel that the questions are — ^been unfair and 
tough. So I’m going to turn the table, and why don’t you all tell 
us what you would — what we — if you were us, what would we have 
you do so that you can get off the list so that we can hold you ac- 
countable. We’re going to start with you, Mr. MacWilliams, since 
you have such a wonderful smile. 

Mr. MacWilliams. Thank you for your question. First of all, the 
point that I would make with respect to the Department of Energy 
and to the chairman’s comments, is we have made progress, but 
the GAO is essentially focusing on half a dozen large capital 
projects where we have had repeated problems, and we still do 
have problems, and so there’s no effort on our part to claim success 
on that, and we welcome your oversight and the oversight of GAO. 

What success we have had is in projects below the 750. I won’t 
dwell on those, but I will point out that in the Department — in 
NSA, for example, the last 3 years, we’re 7 percent below budget 
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and on time. We’ve had other large projects recently such as the 
national Synchrotron project come in on budget. 

The problems that we have, which are systemic, are in our large 
capital projects which tend to be the nuclear projects which are 
among the most complex projects in the world. Therefore, what 
we’re trying to focus on are structural changes so that they last 
past someone like me. I’ve been testifying before you for a couple 
of years, and that’s why we’ve tried to create a much improved 
ISEB, a new project risk management committee, because that 
committee is meant to create enterprise-wide dialog and challenge 
by all the project members from across the programs so that we 
can avoid future problems like this and hopefully get to the bottom 
of the problems that we have. 

The last thing I would just mention, sir, is both of you talked ac- 
countability. That has been a significant issue at the Department 
of Energy. When everybody’s in chargee of a project, nobody’s in 
charge. And so that’s why, as I mentioned earlier, we — the Sec- 
retary has mandated that for every project, we have to have a de- 
fined owner, to the chairman’s question, so that that is the person 
that is accountable when things don’t go correctly. 

Mr. Cummings. Mr. Chairman, I’m going to yield to you. I think 
we have a solution to this issue, and I — and I yield 

Chairman Chaffetz. Thank you. The ranking member and I — 
Mr. Cummings and I have chatted, and I think what we would like 
to do is to send each of you a letter. We would request that you 
would respond within a 30-day period what is your plan? Show us 
your game plan and what you need to do to accomplish that plan. 
Is that — does anybody have an objection to that? Is that fair? 

Mr. MacWilliams. No, sir. 

Chairman Chaffetz. Does anybody have an objection to that? 

Mr. Koskinen. No. 

Chairman Chaffetz. Will you meet that 30-day timeline if we 
send you a letter this week? Fair enough. This is — this has been 
a long hearing. You’ve been very patient taking your time here, but 
that’s what we’ll do. We will send a bipartisan letter. We would ask 
you to respond within 30 days, show us your game plan, and then 
that way I think we can go from here. We do appreciate your com- 
mitment. We appreciate your agencies. Again, most of the people 
there, they’re good hard-working patriotic people, but we’re failing 
them, and if we don’t address it and put a plan in place, we will 
be back here again, and we don’t ever want to do that. So with 
that, this committee will stand adjourned. Thank you. 

[Y^ereupon, at 6:40 p.m., the committee was adjourned.] 
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Questions for the Honorable Gene L. Dodaro 
Comptroller General 
U.S. Government Accountability Office 

Questions from Representative Chaffetz 
Committee on Oversight and Government Reform 

February 11. 2015 Full Committee Hearing on: 

"GAO'S High Risk Report: 25 Years of Problematic Practices" 


1. The High-Risk report notes that you have offered several best practice 

recommendations to federal agencies. However, in some cases, they then turn 
around and spend more time, and presumably more money, on developing their own 
guidelines. This seems wasteful. Why won't these agencies just accept your advice? 
Please elaborate on this situation. 

In most cases, we find that agencies follow GAO's recommendations. As we monitor the 
status of actions on our recommendations over a period of four years, agencies implement 
them on average 80 percent of the time. However, recommendations related to our high risk 
report may identify cross-cutting or long-standing issues that are particularly difficult or 
complex to address. 

We have identified several cases where our reports identify leading practices and make 
recommendations with regard to implementing them, and agencies either do not implement 
them, are slow to implement them, or develop their own guidance or leading practices. We 
understand the need for agencies to, in some cases, translate GAO recommendations on 
leading practices into formal direction to their staffs to (1) give them specific guidance on 
who is to do what, when, and how, and (2) to hold staff accountable for implementing the 
action. Such guidance is helpful and can improve implementation, but it can take a long 
time. Recognizing that adopting leading practices can necessitate culture change in an 
agency, starting action quickly is very important. Congress can also play a key role in 
agencies adopting GAO’s recommendations regarding leading practices, either by requiring 
these practices in law, or conducting oversight of agency operations and the extent to which 
they are responding to GAO's reports, . 

Three examples of agencies not Implementing leading practice recommendations, delaying 
implementation, or developing their own approaches include project management at the 
Department of Energy, and the cross-cutting federal management areas of acquisition of 
goods and services, and IT management. 

The Department of Energy's contract management for the National Nuclear Security 
Administration and Office of Environmental Management remained on GAO's high risk list 
this year. The Department spends billions of dollars managing projects such as construction 
related to the nuclear complex, and to clean up radioactive and hazardous waste. In 
response to consistent cost overruns we have made recommendations regarding improving 
cost-estimating best practices. For example, in January 2010, we found that DOE's cost 
estimating guidance was outdated and recommended that its new policy reflect cost 


1 



141 


estimating best practices we had identified'. DOE agreed with this recommendation, but in 
2013 we found that while DOE had made progress, it had not ensured that its cost 
estimating practices fully incorporated best practices.^ In November 2014, once again we 
recommended that DOE revise its cost estimate guide to reflect a list of 12 cost estimating 
best practices we identified.^ In December 2014, we also recommended that DOE 
incorporate best practices in its analysis of alternative requirements as part of its project 
management.'* In both cases, DOE agreed but did not provide a specific timeframe for when 
it would respond to this recommendation. Our reviews showed that DOE incorporated some 
best practices in its cost estimating and analysis of alternatives guidance, but that this 
guidance is optional. As a result, projects that we have reviewed have not complied with 
best practices. Furthermore, in November 2014, a DOE working group released a report 
addressing project management challenges. The report included 21 recommendations, 
none of which immediately called for implementing our best practices recommendations for 
cost estimating and analysis of alternatives. This is part of the reason we characterized DOE 
as only partially-meeting our high risk criteria of having an action plan. 

With regard to agencies’ acquisition of goods and services, in 2002 we first recommended 
that agencies follow the industry best practice of using strategic sourcing tools to save 
money on their purchase of services.^ It is only in the past 2 years or so that agencies have 
begun to develop and substantively implement such policies, after many further GAO 
recommendations on the subject. In 1999, we recommended that the Department of 
Defense employ technology readiness levels to reduce the disruptions that immature 
technologies cause in weapon system programs.® An initial period of insufficient guidance 
and implementation was followed by the current period of burdensome guidance and review. 
Similarly, GAO and others have recommended that the Air Force adopt best practices for 
satellite control operations^ so that ground stations could control more than one type of 
satellite, but it took many years for the Air Force to begin this effort. In all of these cases, our 
recommendations were both well-grounded in successful practices and conducive to solving 
problems agencies were facing. Excessive implementation delays cost the government time 


' G AO, Department of Energy: Actions Needed to Develop High-Quality Cost Estimates for Construction and 
Environmental Cleanup Projects, GAO-10-199 (Washington, D.C.: Jan. 14, 2010). 

^GAO, Department of Energy: Observations on Project and Program Cost Estimating In NNSA and the Office of 
Environmental Management, GAO-13-510T (Washington, D.C.: May 8, 2013). 

®GAO, Project and Program Management: DOE Needs to Revise Requirements and Guidance for Cost Estimating 
and Related Reviews, GAO-1 5-29 (Washington. D.C.: Nov. 25, 2014). 

''GAO, doe and NNSA Project Management: Analysis of Alternatives Could Be Improved by Incorporating Best 
Practices, GAO-15-37 (Washington, D.C.: Dec. 11, 2014). 

®GAO, Best Practices: Taking a Strategic Approach Could Improve DOD’s Acquisition of Services, GAO-02-230 
(Washington, D.G.: Jan. 18, 2002). 

®GAO, BEST PRACTICES: Better Management of Technology Development Can Improve Weapon System 
Outcomes, GAO/NSIAD-99-162 (Washington: D.C.: Jul 30, 1999), 


'GAO, SATELLITE CONTROL: Long-Tenn Planning and Adoption of Commercial Practices Could Improve DOD's 
Operations, GAO-13-315 (Washington, D.C.: Apr 18, 2013). 
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and money. The simpler solution is for agencies to quickly provide less detailed, interim 
guidance on adopting a best practice so that action, however imperfect, can begin in 
earnest. Course corrections and refinements can be done when better guidance is available, 
but in the meantime, real progress can be made. 

Ensuring the security of federal information systems remains on our high risk list this year. In 
reviewing information security at federal agencies, we have repeatedly reported that they 
are challenged in effectively and consistently implementing an agencywide information 
security program as mandated by the Federal Information Security Management Act of 2002 
(FISMA). Consistent with our report on leading practices for information security 
management, ® FISMA required federal agencies to assess their information security risks; 
select and implement controls to cost-effectively reduce that risk to an acceptable level; train 
individuals on their information security responsibilities; test and evaluate the effectiveness 
of security controls; remediate known vulnerabilities; and establish procedures to detect, 
report, and respond to security incidents. However, we continually identify shortcomings in 
agency programs to protect their computer networks, systems, and information. For 
example, we identified serious and widespread information security vulnerabilities in the 
Federal Aviation Administration’s air traffic control systems that threatened the safe and 
uninterrupted operation of the national airspace system (GAO-15-221 ).® In our audit report 
on the U.S. Government’s consolidated financial statements for FY 2014, we once again 
concluded that deficiencies in information security controls for federal financial computer 
systems constituted a material weakness for financial reporting purposes,''’ Effectively 
implementing the hundreds of recommendations that we make to federal agencies to 
improve information security over their computer systems and networks will better position 
the agencies in managing their cyber risks on an ongoing and consistent basis. The 
Congress passed five laws in 2014 to address cyber security issues; effective 
implementation by agencies and oversight by Congress will be important to making 
progress. 

We added improving the management of IT acquisitions and operations to our high risk list 
this year.” In our May 2014 report, we reviewed five selected agencies’ compliance with the 
0MB requirement for agencies to deliver IT investment functionality in six month 
increments.’^ Agencies have reported that poor-performing projects have often used a “big 
bang" approach— that is, projects that are broadly scoped and aim to deliver functionality 
several years after initiation. One approach to reducing the risks from broadly scoped, 
multiyear projects is to divide investments into smaller parts — a leading practice long 


"GAO, Guide: Information Security Management-Learning From Leading Organizations, GAO/AIMD-98-68 
{Washington, D.C.: May 1, 1998). 

"GAO, FAA Needs to Address Weaknesses in Air TraHic Control Systems, GAO-15-221 (Washington, D.C.; Jan 29, 
2015). 

'°GAO, Financial Audit: U.S. Government's Fiscal Years 2014 and 2013 Consolidated Financial Statements, GAO- 
1 5-341 R (Washington, D.C.: Feb 26, 2015). 

"GAO, High-Risk Series: An Update, GAO-1 5-290 (Washington, D.C.: Feb. 11, 2015). 

'^GAO, information Technology: Agencies Need to Establish and Implement incremental Development Policies, 
GAO-14-361 (Washington, D.C.: May 1, 2014). 


3 



143 


advocated by Congress and OMB.’^ However, our review found that of the 89 selected 
investments at the five agencies we reviewed, only 23 (or 26 percent) planned to deliver 
within the required 6 month window, and only 41 (or 46%) planned to deliver within 12 
months. 

In another example of Congress helping to advance use of leading practices, recognizing 
the severity of issues related to government-wide management of IT, in December 2014, the 
Federal Information Technology Acquisition Reform provisions were enacted as a part of 
Carl Levin and Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 
2015. Among other things, the law includes the requirement that OMB shall provide 
guidance that requires CIOs to certify that IT acquisitions are adequately implementing 
incremental development. Further, as noted in our testimony to your committee in February 
2015, we recommend that to ensure accountability, OMB and agencies should also 
demonstrate measurable government-wide progress in several key areas, including that 
agencies should ensure that a minimum of 80 percent of the government’s major 
acquisitions should deliver functionality every 12 months. 


’^See Clinger-Cohen Act of 1996, Pub. L. No. 104-106 § 5202, 110 Stat. 186, 690 (1996), codified at 41 U.S.C. § 
2308; see also 48 C.F.R. § 39.103 (Federal Acquisition Regulation); OMB, Management of Federal Information 
Resources, Circular No. A-130 Revised. 
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Questions for the Honorable Gene L. Dodaro 
Comptroller General 
U.S. Government Accountability Office 

Questions from Representative Mice 
Committee on Oversight and Government Reform 

February 1 1 , 2015 Full Committee Hearing on: 

“GAO’S High-Risk Report: 25 Years of Problematic Practices” 


1 . Please provide a summary of reports and other products which GAO has produced 
concerning non-VA care reimbursements. 

2. Please provide a summary of reports and other products which, to the best of your 
present knowledge, GAO will produce concerning non-VA care. 

3. What recommendations has GAO made to VA on this subject? 

4. Has VA implemented these recommendations? If not, what reasons has the 
Department provided for not doing so? 


Response to Questions 1. 3, and 4 

Non-VA care is a crucial part of VA's delivery of healthcare services to veterans and is reflected 
in VA's inclusion on the 2015 High-Risk List. Specifically, the recent update to GAO’s High-Risk 
List highlighted concerns with non-VA care related to: (1) inadequate oversight and 
accountability and (2) unclear resource needs and allocation priorities. Since 2013, GAO has 
issued three products and made 17 recommendations that relate to the Department of Veterans 
Affairs’ (VA) payments for services delivered by non-VA providers: 


VA Health Care: Management and Oversight of Fee Basis Care Need Improvement. GAO- 
13-441. Washington, D.C.: May 31, 2013. This report examined (1) how VA’s spending on and 
utilization of non-VA health care (previously known as fee basis care) changed from fiscal year 
2008 to fiscal year 2012, (2) factors that contributed to the use of non-VA health care during this 
time period and steps some VAMCs are taking to reduce the use of non-VA care, (3) VA’s 
oversight of non-VA health care spending and utilization, and (4) VA’s plans and strategies to 
improve the Non-VA Medical Care Program. 


In this study, we found that spending on non-VA health care increased from about $3.04 billion 
in fiscal year 2008 to about $4.48 billion in fiscal year 2012. The number of veterans using non- 
VA health care also increased over that same period— from about 821 ,000 veterans in fiscal 
year 2008 to about 976,000 veterans in fiscal year 2012, The majority of non-VA health care 
spending and utilization during this time period was for outpatient services, rather than for 
inpatient services. 
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We also found that several factors affected VA facilities’ use of non-VA care, including the 
limited availability of certain clinical services at VA facilities, veteran travel distances to VA 
facilities, and goals for the maximum amount of time veterans should wait for VA facility-based 
appointments. However, VA lacked data needed to efficiently monitor areas of non-VA care 
utilization growth or unusually high spending. VA also did not track veterans’ wait times for 
appointments with non-VA providers. 

Taken together, these deficiencies limited VA’s ability to (1 ) compare the cost-effectiveness of 
non-VA care to similar care provided in VA facilities, (2) efficiently assess whether non-VA 
providers were being reimbursed appropriately, and (3) determine whether veterans were able 
to access care more quickly from non-VA providers than they could from providers at VA 
facilities. 


Five of our 17 recommendations related to non-VA care were included in this report and VA 
concurred with all of these recommendations: 

1 . To effectively manage non-VA health care spending, we recommended that the 
Secretary of Veterans Affairs revise the beneficiary travel eligibility regulations to allow 
for the reimbursement of travel expenses for veterans to another VA facility to receive 
needed medical care when it is more cost-effective and appropriate for the veteran than 
seeking similar care from a non-VA provider. 

2. To effectively manage non-VA care wait times and spending, we recommended that the 
Secretary of Veterans Affairs direct the Under Secretary for Health to analyze the 
amount of time veterans wait to see non-VA care providers and apply the same wait time 
goals to non-VA care that are used for VA facility-based wait time performance 
measures. 

3. To effectively manage non-VA care wait times and spending, we recommended that the 
Secretary of Veterans Affairs direct the Under Secretary for Health to establish guidance 
for VA facilities that specifies how non-VA care should be incorporated with other VA 
facility utilization management efforts. 

4. To effectively manage non-VA care wait times and spending, we recommended that the 
Secretary of Veterans Affairs direct the Under Secretary for Health to require during the 
non-VA care authorization process that VA providers and non-VA care officials 
determine the cost-effectiveness of reimbursing medically stable veterans eligible for 
beneficiary travel for travel to another VA facility rather than referring them to a non-VA 
provider for similar care. 

5. To ensure that VA Central Office effectively monitors non-VA care, we recommended 
that the Secretary of Veterans Affairs direct the Under Secretary for Health to ensure 
that non-VA care data include a claim number that will allow for VA Central Office to 
analyze the episode of care costs for non-VA care. 


We have been monitoring VA’s progress toward implementing these five recommendations and 
we expect to close 2 of these soon as implemented. Specifically, we anticipate closing our 
recommendations to: (1 ) establish guidance for VA facilities that specifies how non-VA care 
should be incorporated with other VA facility utilization management efforts and (2) require 
during the non-VA care authorization process that VA providers and non-VA care officials 
determine the cost-effectiveness of reimbursing medically stable veterans eligible for beneficiary 
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travel for travel to another VA facility rather than referring them to a non-VA provider for similar 
care. VA's planned actions are likely to be sufficient to address the remaining three 
recommendations from this report, but VA is still in the process of completing them. 


VA Health Care: Actions Needed to Improve Administration and Oversight of Veterans' 
Millennium Act Emergency Care Benefit. GAO-14-175. Washington, D.C.: March 6, 2014. 
The Veterans Millennium Health Care and Benefits Act (Millennium Act) authorizes VA to cover 
emergency care for conditions not related to veterans’ service-connected disabilities when 
veterans who have no other health plan coverage receive care from non-VA providers. This 
report examined the extent to which (1 ) selected VA facilities complied with applicable 
requirements, in particular when denying Millennium Act emergency care claims; (2) VA’s 
oversight activities ensured that Millennium Act claims were not being inappropriately denied; 
and (3) veterans understand the Act’s emergency care benefit and how VA communicates with 
non-VA providers about Millennium Act claims. 


We found that selected VA facilities were not complying with applicable requirements when 
denying Millennium Act emergency care claims from non-VA providers. This noncompliance 
caused staff at a sample of four VA facilities to inappropriately deny about 20 percent of the 128 
claims we reviewed. We also found that these VA facilities may not have been notifying 
veterans that their non-VA emergency care claims had been denied, as about 65 percent of the 
claims we reviewed lacked documentation of veteran notification. These findings suggest that 
veterans whose claims had been inappropriately denied may have been held financially liable 
for non-VA emergency care that VA should have covered, and they may not have been notified 
of the denials or their appeal rights. 

We also determined that VA lacked sufficient oversight mechanisms and data to ensure that VA 
facilities were not inappropriately denying veterans’ Millennium Act emergency care claims. 
Finally, we found that veterans lacked knowledge about their eligibility for Millennium Act 
emergency care, and selected non-VA providers experienced communication problems and 
other challenges with obtaining timely payment for claims they submitted to VA, 


Twelve of our 17 recommendations related to non-VA care were included in this report and VA 
concurred with all of these recommendations: 

• Six of these 12 recommendations relate to improving VA facilities’ compliance with 
applicable requirements for processing non-VA provider emergency care claims. 
Specifically, these recommendations relate to establishing, clarifying, or revising claims 
processing policies; educating staff; or establishing procedures to help ensure that VA 
facilities take steps to notify veterans about the status of claims for non-VA health care. 

• Five of these 1 2 recommendations relate to improving VA's oversight of its facilities’ 
processing of Millennium Act emergency care claims. Specifically, three of these 
recommendations relate to revising the scope of VA’s existing monitoring efforts, to 
better identify claims processing deficiencies and help ensure that VA facilities correct 
them. The other two recommendations relate to improving VA’s data collection efforts, 
so that the Department will be better able to identify patterns of VA facilities' 
noncompliance with applicable claims processing requirements and areas where VA’s 
communications with veterans and non-VA providers could be improved. 
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• Our final recommendation was intended to improve VA's ability to address its strategic 
plan objective of educating and empowering veterans. Specifically, we recommended 
that the Secretary of Veterans Affairs direct the Under Secretary for Health to take steps 
to better understand gaps in veterans' knowledge regarding eligibility for Millennium Act 
emergency care, such as by conducting veteran surveys of health care benefits 
knowledge, and using information from those surveys to more effectively tailor the 
agency's education efforts regarding the Millennium Act benefit. In conducting these 
surveys, we recommended that VA consider including in these efforts a sample of 
veterans whose past Millennium Act emergency care claims had been denied, in order 
to obtain these veterans’ views and specific details of their experiences. 


We have been monitoring VA’s progress toward implementing many of these 12 
recommendations and we expect to close 2 of these soon as implemented. Specifically, we 
anticipate closing our recommendations to (1) implement measures to ensure that all VA 
facilities comply with VA's policy requirement that incoming claims be date-stamped and 
scanned into the Fee Basis Claims System (FBCS) on the date of receipt and (2) clarify the 
policy for processing Millennium Act claims to communicate the importance of promptly verifying 
that claims have been sent to the correct VA facility, and implement measures to ensure that all 
VA facilities comply with this policy.” VA’s planned actions are likely to be sufficient to address 
2 of the 10 remaining recommendations from this report, but VA is still in the process of 
completing them. 

However, we believe that VA’s completed and planned actions will not fully address the 
remaining 7 recommendations from this report, but we are continuing to monitor them and are 
working with VA to determine what additional actions VA needs to take. For example, in one 
case, we recommended that VA revise policies that relate to processing claims from non-VA 
providers, and the Department updated a procedure guide. While this is a positive step, this 
update did not fully address the goals of our recommendation, and we have communicated to 
VA what additional actions are needed. In another case, we believe that— rather than relying on 
facilities’ self-reported information about compliance with claims processing requirements — VA 
needs to independently assess facilities’ implementation of these requirements. 


VA Health Care: Further Action Needed to Address Weaknesses in Management and 
Oversight of Non-VA Medicai Care. GAO-14-696T. Washington, DC.: June 18, 2014. We 
testified before the House Committee on Veterans Affairs, for a hearing called, “Non-VA Care: 
An Integrated Solution for Veteran Access,’’ which was held on June 18, 2014. In light of serious 
and longstanding problems regarding the timely scheduling of veterans' appointments in VA 
facilities, VA announced its intention to allow more veterans to be treated by non-VA providers. 
Our testimony summarized our findings from GAO-13-441 and GAO-14-175, which are 
described above, and addressed (1 ) the extent to which VA collected reliable information on 
wait times and cost-effectiveness of its non-VA care program; (2) VA facilities complied with 
claims processing requirements for Millennium Act Emergency Care; and (3) VA educated 
veterans about eligibility for Millennium Act emergency care and communicated with non-VA 
providers about claims processing. 


”1116 Fee Basis Claims System is the name of the software VA uses to process claims for non-VA health care. 
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Response to Question 2 


GAO is working on three different studies that relate to non-VA health care: 

• Timeliness of non-VA payments. GAO is presently working on a study mandated by the 
Veterans Access, Choice, and Accountability Act of 2014 (P.L. 113-146, 128 Stat. 1754), 
which will examine the timeliness of VA’s payments to providers of non-VA health care. 
The law directs GAO to survey a variety of non-VA providers from different geographic 
areas about the timeliness of VA payments, as compared to payments they receive from 
Medicare and TRICARE, The law also expresses the sense of Congress that VA should 
comply with the Prompt Payment Rule in paying for health care from non-VA providers. 
At this time, GAO plans to address four main research questions: 

o To what extent does VA comply with timeliness requirements when processing 
and paying claims for non-VA health care? 

o To what extent does VA’s management and oversight of non-VA health care help 
ensure that claims from non-VA providers are processed and paid in a timely 
manner? 

o How does VA’s timeliness for processing and paying non-VA health care claims 
compare to Medicare’s and TRlCARE’s timeliness? 

o What have non-VA health care providers’ experiences been with VA’s claims 
processing — including the timeliness of VA payments? 


• Timeliness of Primary Care Services Provided to Veterans. GAO is also currently 
studying the extent to which veterans can access primary care appointments at VA 
facilities in a timely manner in response to a request from the Chairman of the 
Subcommittee on Oversight and Investigations of the House Committee on Veterans’ 
Affairs. This study relates to non-VA health care because a primary care appointment is 
often needed in order for a veteran to obtain a referral and authorization to seek care 
outside VA. For this study, GAO plans to examine the following key questions: 

o What processes must veterans new to VA’s Veterans Health Administration 
(VHA) follow to access primary care services, and how, if at all, do they vary 
depending on the mode of enrollment? 

o To what extent are veterans new to VHA waiting to be assigned a primary care 
physician? 

o What are VHA’s timeliness standards tor providing primary care appointments, 
and to what extent is VHA meeting these standards when providing primary care 
appointments for new and established patients? 

o What efforts, if any, has VHA implemented or planned to help ensure veterans' 
timely access to primary care services? 


• Veterans’ Access to Mental Health Services from the Department of Veterans Affairs. 
Finally, GAO is studying veterans’ access to mental health care in response to a request 
from the Chairman of the Senate Committee on Veterans' Affairs and Senator Burr. An 
August 2012 Executive Order directed VHA to improve mental health access, including 
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by hiring new providers and establishing a community provider pilot program. Under the 
pilot program, 12 VA facilities established a total of 24 pilot projects with community- 
based providers of mental health and substance abuse treatment services. Most of the 
community-based care in this pilot program is being delivered by non-VA providers, 
either through contracts or on a fee-for-service basis. Our study on mental health access 
currently includes one research question that relates to non-VA health care, which is, “to 
what extent has VHA implemented the community provider pilot program, and what is 
the pilot’s effect on veterans’ access to mental health care?” 
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Questions for the Honorable Gene L. Dodaro 
Comptroller General 
U.S. Government Aexountability Office 

Questions from Representative Duckworth 
Committee on Oversight and Government Reform 

February 1 1 , 2015 Full Committee Hearing on: 

"GAO'S High Risk Report; 25 Years of Problematic Practices" 


Mr. Dodaro, as you know, the GAO has written seven reports recommending that the 
USDA catfish program be repealed to “avoid duplication of federal programs and save 
taxpayers millions of dollars annually without affecting the safety of catfish intended for 
human consumption. This program would require that seafood processors around the 
country, including Fortune Fish, Mazzetta Company, Central Seaway and others in 
Illinois, comply with duplicative and inconsistent regulations by USDA and FDA 
depending on the species of fish. This is exactly the kind of program at high risk for 
waste, fraud and abuse this Committee and this hearing should be focused on 
eliminating. 

As the top official for the government's own watchdog, do you agree that the USDA 
catfish program is duplicative, wasteful and should be repealed? Do you agree that 
spending an additional $2.5 million in taxpayer funds on the USDA catfish program in 
Fiscal Year 2016 as requested in the budget would be an inappropriate use of taxpayer 
funds given that FDA already has jurisdiction over all seafood? 


GAO agrees that USDA’s catfish program would be a duplication of activities because facilities 
that process both catfish and other seafood would be inspected by both the U.S. Department of 
Agriculture (USDA) and the Food and Drug Administration (FDA). On February 7, 2014, the 
President signed into law the 2014 Farm Bill, which did not repeal the USDA catfish inspection 
program. Instead, it modified provisions of the 2008 Farm Bill to require USDA to coordinate 
with FDA to execute a memorandum of understanding that is intended to ensure that 
inspections of catfish conducted by USDA and FDA are not duplicative. USDA and FDA signed 
the MOU on April 30, 2014. GAO maintains that the April 2014 MOU does not address the 
fundamental problem that USDA's catfish program, which becomes effective once USDA issues 
final program regulations, would be duplicative and an inefficient use of taxpayer funds because 
the annual cost to the federal government and industry of this inspection program would be in 
addition to and considerably more than FDA's current program. We have reported in 2012, 

2013, and again in 2014 that Congress should therefore consider repealing provisions of the 
2008 Farm Bill assigning the responsibility for examining and inspecting catfish to USDA and for 
creating a separate catfish inspection program. 
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Dr. Agrawal’s Hearing 
Additional Written Questions for the Record 
Committee on Oversight and Government Reform 
"GAO'S High Risk Report: 25 Years of Problematic Practices" 

February 11, 2015 


Representative Chaffetz 

1. When will the next report on the Medicaid Integrity Program be submitted to 
Congress? 

Answer: The Centers for Medicare & Medicaid Services (CMS) will submit the update on the 
Medicaid Integrity Program as part of the Medicare and Medicaid Integrity Program Report to 
Congress, which we expect to release this fall. CMS has been required to report on Medicaid 
program integrity activities since the enactment of the Deficit Reduction Act of 2005 (P.L. 109- 
171). Section 6402(j) of the Affordable Care Act (P.L. 1 11-148 and P.L. 11 1-152) established 
the requirement that CMS report on Medicare program integrity activities. CMS submitted a 
joint report for the first time for Fiscal Year (FY) 2012.' CMS reported that through the 
Medicaid Integrity Program, CMS directed the activity of the Audit Medicaid Integrity 
Contractors, which identified $12.9 million (includes State and Federal funds) in Medicaid 
overpayments during FY 2012 for recovery by states. Through the State Medicaid Recovery 
Audit Contractor programs, states have recovered a total Federal and state share combined 
amount of $95.6 million, and returned a total of $57.6 million to CMS for FY 2012. CMS also 
provided direct support to state activities that led to substantial recoveries - including 
$ 1 .4 billion reported by states for FY 2012. Importantly, CMS has laid the groundwork for 
additional savings with the implementation of innovative technology, and is continuing to refine 
an approach to measuring the impact of initiatives that achieve cost avoidance. 

CMS also recently published the Comprehensive Medicaid Integrity Plan (CMIP) for 
FYs 2014-2018,^ which sets forth the strategy of the CMS to safeguard the integrity of the 
Medicaid program during FYs 2014-2018. This Plan is designed to strengthen the ability of the 
Federal-state partnership to safeguard the integrity of the Medicaid program. The execution of 
this Plan will improve the ability of state Medicaid agencies and CMS to leverage program data 
to detect and prevent improper payments, which will strengthen states' ability to safeguard state 
and Federal Medicaid dollars from diversion into fraud, waste, and abuse. These efforts will 
expand the capacity of CMS to protect the integrity of the Medicaid program and to manage risk 
in the administration of Federal grants to states. 

The CMIP also addresses new requirements as well as ongoing Medicaid program integrity 
issues. It is informed by our evaluation of past and current program integrity efforts by CMS and 
its state partners. It is also infonned by recommendations made by the Department of Flealth and 
Human Services' Office of Inspector General, the Government Accountability Office, the 


' http://ww\v.cm.s.gov/Aboul-CMS/ComDonent.s/CPlAyidgets/CMS-Program-lntegritv-ReDoit-to-Congress-FY- 
2012.Ddf 

^ hltp://www.cms.gov/Regulatioiis-and-Guidance/Legislalion/DeficilReductionAct/DQwnloads/cmip2014.pdf 
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Medicaid and CHIP Payment and Access Commission, the National Association of Medicaid 
Directors (NAMD), and ongoing feedback and engagement of the Medicaid Fraud and Abuse 
Technical Advisory Group. In keeping with recommendations by these stakeholders, CMS has 
already implemented improvements as well as discontinued activities that have not proven cost- 
effective. Additional recommendations by these stakeholders will be implemented as part of this 
five-year Plan. 


Representative Duckworth 

1. CMS has had a prior authorization demonstration project confined to one or two 
DME items, e.g. power wheelchairs, and in 2014 announced that it was expanding 
the demo project to a few more specific DME items, but also, to ALL prosthetic 
devices. Are you concerned that applying a new approach to ALL of one product 
category, as opposed to a few selected items, as is the case with the DME, goes 
beyond the concept and confines of a demonstration project, and arc you concerned 
that expanding the scope of prior authorization too rapidly in the area of prosthetics 
could actually disrupt patient care by creating a barrier between the amputee and 
their prosthetist? 

Answer: CMS has a number of prior authorization initiatives underway. AVhile some 
lower-limb prosthetics were included in the proposed regulations implementing prior 
authorization for some Durable Medical Equipment, Prosthetics, Orthotics and 
Supplies (DMEPOS), we have not issued final policies for the particular items discussed in the 
proposed regulation. Under the proposed rule published May 28, 2014, Prior Authorization 
Process for Certain DMEPOS Items (CMS 6050-P), CMS proposed that only items above 
$1,000 or more and subject to additional criteria would be considered for a prior-authorization 
process. Timely access to care is of utmost concern to CMS. CMS’ prior-authorization 
processes take into consideration items that may be needed quickly and provides alternative 
timelines to ensure beneficiaries receive timely access to necessary items and services. For 
example, CMS proposed offering an expedited review process for circumstances where the 
standard timeframe for making a prior-authorization decision could jeopardize the life or health 
of the beneficiary. Current prior authorization initiatives do not create additional documentation 
requirements or delay medical service. It requires the same information that is currently 
necessary to support Medicare payment, but earlier in the process. CMS believes prior 
authorization is an effective way to ensure compliance with Medicare rules for some items and 
services. To date, CMS’ prior authorization initiatives have not been shown to create barriers 
between the beneficiary and the provider, or otherwise disrupt patient care. 

Current prior-authorization initiatives include: 

• Power mobility devices - This demonstration started on September 1, 2012, in seven 
states, and has been expanded to 12 additional states, for a total of 19 states. CMS 
believes this demonstration has contributed to reductions in improper payments for 
power mobility devices, which will help ensure the sustainability of the Medicare 
Trust Funds and protect beneficiaries who depend upon the Medicare program. 
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• Repetitive scheduled non-emergent ambulance transport - This model started in 
December 2014 in New Jersey, Pennsylvania, and South Carolina. CMS is testing 
whether prior authorization helps reduce expenditures, while maintaining or 
improving quality of care. 

• Non-emergent hyperbaric oxygen therapy - This model is scheduled to start March 
1, 2015, in Illinois, Michigan, and New Jersey. CMS is testing whether prior 
authorization helps reduce expenditures, while maintaining or improving quality of 
care. 

2. It has been suggested that prior authorization constitutes a provider 

reimbursement arrangement that will help CMS move away from the current 'pay 
and chase' model. However, some providers are concerned that prior authorization 
may represent an additional juncture at which providers must prove medical 
necessity, and despite receiving CMS authorization, find themselves being audited 
after an authorized device or service is provided to the beneficiary. Does Medicare 
prior authorization constitute a promise to pay? 

Answer: Comments received by CMS from stakeholders on the concept of the Medicare Fee- 
for-Service prior authorization effort have been positive. The goal of prior authorization is to 
ensure compliance with Medicare requirements prior to the service being provided. The 
advantage to the supplier is that this process allows for the identification and correction of any 
problems with documentation or coverage. The other advantage is that this process is completed 
prior to the issuing of the payment. An affirmative prior authorization is a preliminary finding 
that a future claim meets Medicare’s coverage, coding and payment rules. Claims could be 
reviewed and denied based on technical requirements that can only be evaluated after the claim 
has been submitted for format processing, for example, a valid proof of delivery or duplicate 
billing. Generally, a service that has received prior authorization is protected from future audits 
unless there is evidence of potential fraud and abuse or gaming. 


o 



